MAL-2026-12182

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/json-validator-utils/MAL-2026-12182.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12182
Published
2026-08-05T09:09:29Z
Modified
2026-08-05T13:35:34.441654419Z
Summary
Malicious code in json-validator-utils (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (255dbc17164a6243a92bab0b4d71132efad3028b53e73d7d2924a1d7ccd1e8cf)

The package advertises itself as a JSON/XML validator but lib/core.js contains a multi-stage dropper triggered on any call to the public API (validateJson/validateXml). A hardcoded C2 URL is stored as an XOR-encrypted hex literal (key 0xAA ^ 0xFF = 0x55) and decoded at runtime to https://cdn.jsdelivr.net/gh/cryptonomad411/cool-utils/package.json — a personal GitHub account unrelated to the package's stated purpose. The decoded manifest supplies a platform+arch-keyed payload URL that is downloaded to /tmp or %TEMP% and executed (cscript on Windows; chmod+x and spawn('sh',...) on Linux/macOS). Execution is gated behind os.uptime() >= 300 to evade short-lived analysis sandboxes and CI containers. After running the second-stage payload, the Linux branch writes a randomly-named unit to ~/.config/systemd/user and enables it via systemctl --user enable --now, and the macOS branch writes a randomly-named plist to ~/Library/LaunchAgents and loads it via launchctl load -w, granting persistent auto-start execution of attacker-controlled code on the installer's host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "1.1.0"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-014571",
            "sha256": "255dbc17164a6243a92bab0b4d71132efad3028b53e73d7d2924a1d7ccd1e8cf",
            "import_time": "2026-08-05T09:28:26.684271816Z",
            "modified_time": "2026-08-05T09:09:46Z"
        },
        {
            "versions": [
                "1.0.1"
            ],
            "id": "IN-MAL-2026-014569",
            "source": "amazon-inspector",
            "sha256": "85655b7c3b2a246107b7e7460f7ad76333a95a7739307941c843dd75464c60f6",
            "import_time": "2026-08-05T09:28:26.51567614Z",
            "modified_time": "2026-08-05T09:09:29Z"
        },
        {
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-014674",
            "sha256": "52c9bfd2eda4e95dfe84ebb46bfda7791d386fb26e7d71dcb52b0e2f20e8c628",
            "import_time": "2026-08-05T13:08:36.070451805Z",
            "modified_time": "2026-08-05T12:29:08Z"
        },
        {
            "versions": [
                "1.1.2"
            ],
            "id": "IN-MAL-2026-014801",
            "source": "amazon-inspector",
            "sha256": "7a3bfda78a054ba281a3fcd02dae15433dbe98ab9294cb164756b50cfb28ce6f",
            "import_time": "2026-08-05T13:08:47.483491169Z",
            "modified_time": "2026-08-05T12:53:20Z"
        }
    ]
}
References
Credits

Affected packages

npm / json-validator-utils

Package

Name
json-validator-utils
View open source insights on deps.dev
Purl
pkg:npm/json-validator-utils

Affected ranges

Affected versions

1.*
1.0.0
1.0.1
1.1.0
1.1.2

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "json-validator-utils-1.1.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-hoLOXhoDGjPHpq1Qb8C6vSRk3Gw6oFdhmLCCntmTeFomtTkJP8KLFV6MPrD4GJeXldp9+MwV02rtrkklgqyAEg==",
                "sha1": "48bad273810b4565cdc4739d544782a35cb41af4"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "4ed1549925e2e12445f267a98b53c91be91bb02337018458feecc3816ff2565c263efc",
            "sha256": "c8676799ec3c52381dec046be61e7d2db88a436390a8451ab4c5efaf94468cf5",
            "path": "lib/core.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/json-validator-utils/MAL-2026-12182.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]