MAL-2026-11143

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/parallely/MAL-2026-11143.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-11143
Published
2026-07-28T13:33:43Z
Modified
2026-07-28T14:37:06.662586131Z
Summary
Malicious code in parallely (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8c7ec817d7407cffaa25209d066c7782cd74a1f91ea850887f7d2d85766b5f67)

parallely impersonates the concurrently package: package.json copies concurrently's author (Kimmo Brunfeldt), repository (open-cli-tools/concurrently), README, and ships bin entries named concurrently and conc. dist/lib/spawn.js injects a dropper into resolveShell() that fires whenever the library's concurrently() API is invoked or its concurrently/conc bin is run. The dropper re-spawns itself detached with an env guard to run once, performs anti-analysis checks (Linux /proc TracerPid, Node --inspect/--debug flags, inspector.url()), reconstructs an AES-256-GCM key by XOR-combining four base64 blobs, decrypts a hidden download URL via createDecipheriv("aes-256-gcm",...).setAuthTag(...), fetches a platform-specific payload, writes it to os.tmpdir()/ins-<euid>/{linux|mac|win.js}, and executes it detached with stdio ignored and windowsHide set. The destination host is not present as a plain string, defeating static extraction.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "8c7ec817d7407cffaa25209d066c7782cd74a1f91ea850887f7d2d85766b5f67",
            "import_time": "2026-07-28T14:19:58.25060629Z",
            "versions": [
                "10.0.3"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-010901",
            "modified_time": "2026-07-28T13:33:43Z"
        }
    ]
}
References
Credits

Affected packages

npm / parallely

Package

Name
parallely
View open source insights on deps.dev
Purl
pkg:npm/parallely

Affected ranges

Affected versions

10.*
10.0.3

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "sha256": "35496f986465690f27e8e6f36c31ad458a414379f3e7438e12b5270509f33721",
            "tlsh": "1082955faafb21319263b03d8b6f8805b1b7c153174cdda4be2c92606f154385bb6bd8",
            "path": "dist/lib/spawn.js"
        },
        {
            "sha256": "ab9d3f2d02649cc874d6089c788e336daba3a04822092e16682082169d4d5b0e",
            "tlsh": "63411f70c8a18d534ac801aebc3d2392a135481b9d86fd0db3c1531c4f4cadf71ba69e",
            "path": "package.json"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "de495a5f888e90c10767637e29e712c94ad96651",
                "sha512_sri": "sha512-pWByLZBdw4OFNVIRoFMKyn+Z87pm+8ofCjRPb0QBdr1YCY/AuhjiVePDNMTaP1LDv7HnJrxnY7w5JC4q33IUzg=="
            },
            "filename": "parallely-10.0.3.tgz"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/parallely/MAL-2026-11143.json"