MAL-2026-11498

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@custombots/custombot/MAL-2026-11498.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-11498
Published
2026-08-02T02:43:26Z
Modified
2026-08-05T00:34:59Z
Summary
Malicious code in @custombots/custombot (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b88fd82e9d147a4fad43b89bab0b975fe57714abf16356eb39ec0ae62dcc7949)

index.js opens a TCP connection to a base64-obfuscated IP address (decodes to 85.137.253.124:1111), spawns /bin/sh, and pipes the shell's stdin/stdout/stderr through the socket, giving the remote endpoint an interactive shell on the installer's host. package.json declares "postinstall": "node install.js"; install.js uses node-linux's Service API to install index.js as a Linux systemd service named CustomBot and starts it, aborting unless run as root and prompting the user to run sudo npm i. The combination provides remote code execution against the installer with root privileges and reboot persistence. The C2 IP is stored as the base64 literal 'ODUuMTM3LjI1My4xMjQ=' and decoded at runtime, consistent with deliberate concealment.

Source: ossf-package-analysis (07c87d7c1e7e788959af6de895c76293fd0922dd1a422da325962de7f8d3d19a)

The OpenSSF Package Analysis project identified '@custombots/custombot' @ 1.0.0 (npm) as malicious.

It is considered malicious because:

  • The package executes one or more commands associated with malicious behavior.
Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-02T23:51:44.719843886Z",
            "modified_time": "2026-08-02T02:43:26Z",
            "sha256": "07c87d7c1e7e788959af6de895c76293fd0922dd1a422da325962de7f8d3d19a",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-010979",
            "import_time": "2026-08-04T21:33:12.093859063Z",
            "modified_time": "2026-08-04T21:13:00Z",
            "sha256": "00209d00ff27a3d232edd8c0cd091e9289ae12986a50e7938d84b1060068273c",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-011366",
            "import_time": "2026-08-05T00:04:39.374543221Z",
            "modified_time": "2026-08-05T00:01:50Z",
            "sha256": "0bc5799c50ef6743c402fdfb9510eae5f2cd47de8ffa245fd81ef1484739cc2a",
            "source": "amazon-inspector",
            "versions": [
                "2.0.1"
            ]
        },
        {
            "id": "IN-MAL-2026-011365",
            "import_time": "2026-08-05T00:04:39.266074691Z",
            "modified_time": "2026-08-05T00:01:39Z",
            "sha256": "8fffb833144f5fa1f95be35877b94e173922b2d5e2280232b84c303ffafd8937",
            "source": "amazon-inspector",
            "versions": [
                "2.0.2"
            ]
        },
        {
            "id": "IN-MAL-2026-011367",
            "import_time": "2026-08-05T00:04:39.473017638Z",
            "modified_time": "2026-08-05T00:02:05Z",
            "sha256": "b88fd82e9d147a4fad43b89bab0b975fe57714abf16356eb39ec0ae62dcc7949",
            "source": "amazon-inspector",
            "versions": [
                "2.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @custombots/custombot

Package

Name
@custombots/custombot
View open source insights on deps.dev
Purl
pkg:npm/%40custombots/custombot

Affected ranges

Affected versions

1.*
1.0.0
2.*
2.0.0
2.0.1
2.0.2

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "b2c0ddf45b5b0683ab837a0dd8186cdd2ea30266080a7d057bb1023bb747349d",
            "tlsh": "1ae0d89db4b365776173327ac63fc41b373340263612e2a9b44d49dc0f6240c2e2faa9"
        },
        {
            "path": "package.json",
            "sha256": "585e5d8e6337f34a1690591d645e9b6d0481f46a5aa81e3b1910b1c975993437",
            "tlsh": "31d0a7140930623335c0cda4542b244b7b5e47181108441507e5901482ed6bf54bff1d"
        }
    ],
    "package_integrity": [
        {
            "filename": "custombot-1.0.0.tgz",
            "hashes": {
                "sha1": "3d883f093a9bab9845b3d8993397f5324ea8bd40",
                "sha512_sri": "sha512-oFxw1rI1klYIgTGUs7Qd7MJDJamtYSae9uhsA+JKUMSxLvfJz3pa3YHPn60EjjXMmCvhlBDjmSeYkGgOHYs+AQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@custombots/custombot/MAL-2026-11498.json"