MAL-2026-11029

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/lychee-norm-cache/MAL-2026-11029.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-11029
Aliases
  • GHSA-pj38-6jj4-4x3p
Published
2026-07-23T01:07:33Z
Modified
2026-08-05T06:36:19Z
Summary
Malicious code in lychee-norm-cache (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (23ee684fa7edabc6e34aedc6e32e36c42fb68100a69908227e639d53592565de)

lychee-norm-cache is a dependency-confusion proof-of-concept that provides no functional utility. Its bin script POSTs a small JSON payload containing the package name, a timestamp, and the basename of INIT_CWD (the directory in which npm/npx was invoked) to a hardcoded callback URL at https://deepbounty.dd06-dev.fr/cb/. The package has no install lifecycle scripts and the declared main entry is absent, so the beacon fires only when the bin is explicitly executed (typically via npx, or when this name resolves in place of an intended internal package). The data sent is minimal and non-credential (project directory name only); there is no exfiltration of environment variables, files, or secrets, no remote code execution, and no persistence. However, the package occupies a namespace that may collide with internal package names and silently emits installer-side context to a third-party host without consent.

Source: ghsa-malware (b7ad5acb0beb469a4f953cb1e1adab206bf03ad18d45c11b5cb895b1aff79114)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "GHSA-pj38-6jj4-4x3p",
            "import_time": "2026-07-23T07:45:08.783042214Z",
            "modified_time": "2026-07-23T01:07:34Z",
            "ranges": [
                {
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ],
                    "type": "SEMVER"
                }
            ],
            "sha256": "b7ad5acb0beb469a4f953cb1e1adab206bf03ad18d45c11b5cb895b1aff79114",
            "source": "ghsa-malware"
        },
        {
            "id": "IN-MAL-2026-012907",
            "import_time": "2026-08-05T06:00:18.536029286Z",
            "modified_time": "2026-08-05T05:06:18Z",
            "sha256": "23ee684fa7edabc6e34aedc6e32e36c42fb68100a69908227e639d53592565de",
            "source": "amazon-inspector",
            "versions": [
                "22.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / lychee-norm-cache

Package

Name
lychee-norm-cache
View open source insights on deps.dev
Purl
pkg:npm/lychee-norm-cache

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

22.*
22.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "bin/run.js",
            "sha256": "dc66dc89ef8c8151a3ceac5470eb7378a1c201bc2e2ee2325e4440fbcc8ef4a0",
            "tlsh": "622132806ad25a3416e65fd09a5b9c0f7227a11b7e42f0a4b99c42881fc813c5572bce"
        },
        {
            "path": "package.json",
            "sha256": "14f6c20209441d01b62fd0261a51b39a10f3bdfbb658e6d48bc0dcc7cfbb354f",
            "tlsh": "18c0120d0416681327418eec1c7ea6c4912d03682556d819195c3174c2f9ab6762a7c6"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/lychee-norm-cache/MAL-2026-11029.json"