MAL-2026-12183

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/nolimit-agent/MAL-2026-12183.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-12183

Published

2026-08-05T08:50:21Z

Modified

2026-08-05T10:06:11.118570060Z

Summary

Malicious code in nolimit-agent (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (9e9510731400dde41fd6705895d15e78bf4fe6f4560162a10bd6016e855f4221)

The package tarball contains a hidden top-level directory .ad/ populated with ~40+ heavily obfuscated JavaScript files (advanced-evasion.js, from-generator.js, phone-validator.js, proxy-validator.js, sms-providers.js, smtp-health-cache.js, socks-loader.js, web-command.js, and x0.js through xz.js). All files use hex-identifier obfuscation (_0x-prefixed symbols, single-line minified layout) consistent with javascript-obfuscator output designed to hide code behavior. The naming pattern (advanced-evasion, socks-loader, sms-providers, smtp-health-cache, phone-validator, web-command, proxy-validator) is aligned with SMS/SMTP/SOCKS abuse tooling — bulk-messaging, proxy-chained credential/SMS pumping, and evasion of anti-abuse controls. Placing these files in a dot-prefixed directory hides them from casual directory listings and package browsers. Obfuscation across every file in this directory, combined with the abuse-tooling module names, is inconsistent with a legitimate library and matches the shape of an operational abuse/attack toolkit distributed via npm.

Database specific

{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T08:50:21Z",
            "sha256": "9e9510731400dde41fd6705895d15e78bf4fe6f4560162a10bd6016e855f4221",
            "id": "IN-MAL-2026-014437",
            "versions": [
                "1.0.343"
            ],
            "import_time": "2026-08-05T09:28:10.92695566Z"
        }
    ]
}

References

https://www.npmjs.com/package/nolimit-agent/v/1.0.343

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com

Affected packages

npm / nolimit-agent

Package

Name: nolimit-agent; View open source insights on deps.dev
Purl: pkg:npm/nolimit-agent

Affected ranges

Affected versions

1.*

1.0.343

Database specific

cwes

[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]

indicators

{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-UXQYtefEwji2iDlqSPqvBIvobuxTSv4U8Ab2tMQowfbrhZIybzSPkEC2T4A2TDoEJvG3UlEad1F+WESyfk66Rw==",
                "sha1": "ee3a2593f2949fef272d1ae191b91cd261b2df58"
            },
            "filename": "nolimit-agent-1.0.343.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": ".ad/advanced-evasion.js",
            "sha256": "07e5a7cd0de08d118c197cacddc941e19ac0331998d49525cdfa4531f948d5d9",
            "tlsh": "b1921a906380329e1383ebb7b92764d1d56a54b739448c8773d87d1cb8e8a5debd8b30"
        },
        {
            "path": ".ad/from-generator.js",
            "sha256": "abd3851cd556e59fd5a791ff1e40e27c6ca12b29f4dd03f5fdb03dc17cfdd1ca",
            "tlsh": "f8f1a5447e85368a7b4b0ed3353b68e4dc095c877d64ac4ab9b4b854ac019bdc0eeb34"
        },
        {
            "path": ".ad/phone-validator.js",
            "sha256": "26e33c23f01a846cfdb358498845c17fa33759560e7bc4ba4686f17e95c3326c",
            "tlsh": "75f1c890a6453160eb4f6beb2b13b0d0e45d58be7ba41cced16878cdad616b2d2d0e30"
        },
        {
            "path": ".ad/proxy-validator.js",
            "sha256": "7b18f57d7d2ff0a5ac973eb3cb26faf90894a456e8fd1f0156a01e5102a12420",
            "tlsh": "8622f84067c02180b7072ff3ad3750e1da3c1d4b7a50988fe448a8acf922d16ebe9a30"
        },
        {
            "path": ".ad/sms-providers.js",
            "sha256": "50429d4bf5b956dad6912c203c722ec1f540fdf4a434c0a3a784675127385262",
            "tlsh": "9e82f7cdd8c275855f8e2ef7bb03e4d1e17a044e75488caee104bc1caa62a21d7f5a74"
        },
        {
            "path": ".ad/smtp-health-cache.js",
            "sha256": "d2ff094083cf5cef00ad7cc23dd38161844b18d8eafaa424d9f720c651d54bf6",
            "tlsh": "3332b7407684a9c1bb875ffb7a23b0cdf5799c4e7480058bd28878692ee1977fac0531"
        },
        {
            "path": ".ad/socks-loader.js",
            "sha256": "dbcdef1589fe11f5d84f02044686c9d3ad81d372c168e8105279ec6f3dd13aa1",
            "tlsh": "4af1855077d137d9974b46f3931e62e3e61e985b394c4c5fe010aea96ca1038d3dea34"
        },
        {
            "path": ".ad/web-command.js",
            "sha256": "3f483f30d554feb8752200c5a4611f297882f138436e2f89ef0165ca2908f283",
            "tlsh": "309218a866c4b09c574613f33e2764b8eb6829567049c70be4a0fcbc2e9674ae5ec131"
        },
        {
            "path": ".ad/x0.js",
            "sha256": "c2f38a28e27a804a7ae06a24581768d6dd02dbbae7ce21ed92ea870daca8ee22",
            "tlsh": "6983d96cdad4384a774217f7ff2760c2e64e1869b484e94be9d4bc0c14a2672f6e4b31"
        },
        {
            "path": ".ad/x1.js",
            "sha256": "410030d5032d83d1af84cc5eb2997e512aabb2952d8d507eb24bbb1362ded5c4",
            "tlsh": "4ba3c68897c439e9b34a2bfb761371d1e94948aa34c49dc7f4c4b81cb499a3bfad5130"
        },
        {
            "path": ".ad/x10.js",
            "sha256": "d23f9179efabd8dc94296f7ce6b528cfc516054bf307c4f28da23e835ff1bc60",
            "tlsh": "e562c855a7c03c9a674f4ffbb63370d1c65c449a744c8806ea84bea96cfa617f8d4930"
        },
        {
            "path": ".ad/x11.js",
            "sha256": "14c7133a735d4d8d3aa8f12263312ac8a863c77004f2fe3c6580a4cb3ec15c36",
            "tlsh": "c592e844b3c1b480734a5edb7327b4c0e45da49e78895d8ff8887e2e3d25616e2d6b30"
        },
        {
            "path": ".ad/x12.js",
            "sha256": "21f709a72d6f337f16fe8de87b93958ced524a650469617d4c74842d831245fe",
            "tlsh": "b5e2c706da843ed1139f5ef77662b0e1c52a08c5b214cd77b888f86e1ae5b27e5c5630"
        },
        {
            "path": ".ad/x13.js",
            "sha256": "5782fe40eab5808037c6bfa090c4d29df76734392f70f61b27e1c0bd714c15f8",
            "tlsh": "f852d7a06bd07060832f47eb6786e0c0d22b968e746a4c9df989781c6c35e69cde6735"
        },
        {
            "path": ".ad/x2.js",
            "sha256": "dbd5be6c96b8e6bb53ba088f52f6710b35361ac6fcfa554fbc0a8466d664c050",
            "tlsh": "4623d6982e95fa84a34a37e77e12f0f7e06b49597048094be8d4bd1c7897623e5ec730"
        },
        {
            "path": ".ad/x3.js",
            "sha256": "3b4434a74cdb2eac75b9905d9865ac98a3299fafa1b769732c7a20928997dde1",
            "tlsh": "cb92d740a390255c234b1ef73e1375d0d95b186e3c898d8ff8a8bc1d6aa9712f1fa231"
        },
        {
            "path": ".ad/x4.js",
            "sha256": "620d15b1b597635c00c255b032f70ab83060eab010a83a4f238b339e968edbf8",
            "tlsh": "1b42b522bac9788433465ff73f2b9cf5e62d848d38440d8f94d9f9086c55ab1e6d8632"
        },
        {
            "path": ".ad/x5.js",
            "sha256": "2531db9a447da5c933482363b0cb19bda8bedb470db777221163797518193bb2",
            "tlsh": "8c02e97879c171907f416beb650b78f9d619084638a5cd0eb145be3dfceb11ad5e0a30"
        },
        {
            "path": ".ad/x6.js",
            "sha256": "16ee4dbbbf83300217f80cd097886ea633efb2fc53f1dc9b1913dd3eda5c58dd",
            "tlsh": "e8d2d690629431c0334a16f7b23b72c4f65e944e3d98ac87fa90be5c6972626e3d1f35"
        },
        {
            "path": ".ad/x7.js",
            "sha256": "635d4a5924ed8e3a6d63b52e0be0eb74764ddaaa3f70b93e3e725653b0b95752",
            "tlsh": "1d82fa5657d52d48a70362ff312b94e2c26c4881370a0c46e9b4ec3cbcea687fdd62b5"
        },
        {
            "path": ".ad/x8.js",
            "sha256": "6358436c31c85e88ff76c6ac2e1fd546aafdffc718bf6903401f6eeaadcfb93d",
            "tlsh": "a042b7247ba475405f4b5feb6333b0d1e90d895b38c44606e4987da83c61326e7f6a39"
        },
        {
            "path": ".ad/x9.js",
            "sha256": "135231c5cabf589aa8c4b234c61f86369fd6a3ac9f6341914c5d346872d70991",
            "tlsh": "1f434d78e280e55f9fe36ef72a02b09ed3991cdd774588b9b5847c0ce651236e4a0633"
        },
        {
            "path": ".ad/xa.js",
            "sha256": "3ed4dc717288850e77a178a850fe8829a1225143e02a94d463f355c53a282571",
            "tlsh": "e6b2f89c6658659513461ffb7f11b0edf54e8c6a7888888be2487c8c3d92722dfe8c35"
        },
        {
            "path": ".ad/xb.js",
            "sha256": "cabcdd9baf6a127f9150674d008980998f2c77d6070bd324159af99910e6a438",
            "tlsh": "72d2f890f747fca8130eabfb3b23b0d0d65756e664984947e080b84d79d875ae2ed630"
        },
        {
            "path": ".ad/xc.js",
            "sha256": "87a2d0e0f9a7b95fcaa4f9737d84bd9222b7f57d34a1e81fb3b0c502aebb1b7b",
            "tlsh": "0072a541b3806dd43b070bfbb60670d1e29e68ad7a5d0c4bb49c3d9e18f9a16f2d9931"
        },
        {
            "path": ".ad/xd.js",
            "sha256": "ce2ed4c1573110a6a51997e8f595649a1bbd731a61d421cb30805801a78283c4",
            "tlsh": "32e23c80a7e636e833472bfb7e7260c1d69d945d3901884bf9887d2c7494b16eae4634"
        },
        {
            "path": ".ad/xe.js",
            "sha256": "e4ffaf208c4968aff98244a319ddbaf6e54f67dc19cc601d454961029233c6ba",
            "tlsh": "2ad219e0e3c129d423075ff33f37b1c1e64e4819387a416ad588e91eb49a16bd6f8a35"
        },
        {
            "path": ".ad/xf.js",
            "sha256": "ad9c48709cfc504fd682bb87cafc5ef2412c4f7ec5eba227a23f8b93bd05c8a0",
            "tlsh": "6453396062993995370366f73f2271f2f26a481e3899489bf9943c5c748e633e7f8931"
        },
        {
            "path": ".ad/xg.js",
            "sha256": "b1b740a9f6ce96ecbe29d1344d425d9054f583a496073196125b66353b37c227",
            "tlsh": "e4229490778039a52b471ee37a2650d1ee1e499a398c9447fbe4bd483db0e23e4fd634"
        },
        {
            "path": ".ad/xh.js",
            "sha256": "8ca6c9c01b7d4da19fbdfb7d1bfe00ce79cba229202efe0cf956492ed8e89bb5",
            "tlsh": "d64285107ae03fb033823afbb37b60d5e199549b39a5088bf454fc4d6896915f9e5b30"
        },
        {
            "path": ".ad/xi.js",
            "sha256": "3613e790a3eef651e6412582686d0bd77457ea436864be3cbd6f77d75b39d2e0",
            "tlsh": "9142b640b5c4fd8c139b57a7b632b4e0e82a4b9b38499b07f1d0bd9c2f96522c5dca34"
        },
        {
            "path": ".ad/xj.js",
            "sha256": "a890cf293f05c159072b037e0d3688f47acee3c7d968534b4271d7c3bff25199",
            "tlsh": "3592e810b7d02994b3875ba7f323a0d6e0564c6678d49e87f694bd3c5c89637e2e8b30"
        },
        {
            "path": ".ad/xk.js",
            "sha256": "2bed8c166d876ac1064ca1ae9a0e00664fcd68ccd6cad453357a584ae57a85d8",
            "tlsh": "bfb16254a7803aa15757abbb392770d4da3d58933dac484fe500ecc48deaa01fbf5a30"
        },
        {
            "path": ".ad/xl.js",
            "sha256": "8e9764d04b397cccbde00f0b30e9b2baca9391d783cc00c3ad666a3db2abb394",
            "tlsh": "3f22a410e5d435986b471aeb3b32a0c0e64d9c9f3518ac97fe85bc187462731e5eee32"
        },
        {
            "path": ".ad/xm.js",
            "sha256": "8c5863324650927a402ebd80fb4739ade2cc48bcc9928c966a931e832b00e747",
            "tlsh": "680273c4b9b87469624b6ff37e5372d3d44c58e63465888fe044a83e5ee5a16c1f1e30"
        },
        {
            "path": ".ad/xn.js",
            "sha256": "479fe112fa8362540e1690259321e60b618b987183af64a47540bf0fbf596af2",
            "tlsh": "f1b2c544b34c2cd693cb5af7eb36e0fae625ab567908485ae1807c3e8152013d7e8637"
        },
        {
            "path": ".ad/xo.js",
            "sha256": "09e4e3eeef7d10bc93d79d297408d586aaab10cd6c80a7b3a4ead91762beafe5",
            "tlsh": "6a92d6c8e3d438d463095ef73d27f2d9f00a5d9d384c8c6be148695c79a2216e5faa31"
        },
        {
            "path": ".ad/xp.js",
            "sha256": "95e0d55fd291a9db2bc956e11b154e2e92e35248df90628985bb4774a6772b29",
            "tlsh": "f8b2299aa195648d034f57f77127b8c1c12d5cda3848e8dbf8b4fd4d69152b8e3c8a38"
        },
        {
            "path": ".ad/xq.js",
            "sha256": "5d4312f4975c1dc64f0c302541e77c012ba670ea3783b9caf24b598c76ab068c",
            "tlsh": "04421910b3d530a7671b57fbb22770e5e05a4946bad5889bf4c02cbd786162be2d8f30"
        },
        {
            "path": ".ad/xr.js",
            "sha256": "7d34af1030081d54eb373ace973cbc71a98e9e175e60a1825b14c7a39e8a9bab",
            "tlsh": "72922988f3d17dd473025bf3b123a4d1f69d64873c88889be5587c0e65e822be5e6a31"
        },
        {
            "path": ".ad/xs.js",
            "sha256": "06bb2ca0547c5a3c8529f7b59a59c4fb5e9f9c5768e05ccd55cf2384cecb8aec",
            "tlsh": "32f2c6c921803564a38b3fff6e2326e1c69d484d7d46898fe518bd5c29e2913e7f8934"
        },
        {
            "path": ".ad/xt.js",
            "sha256": "e8d9e7929592a35ca43cfc01758397e28fb33fa323e538d3ef92edcf5a935750",
            "tlsh": "e292f90076d078287752ced7353268c3c5cda4ade1490a16b694bfec2d78923efe9530"
        },
        {
            "path": ".ad/xu.js",
            "sha256": "96819970168fcafebb35c57de49d4e909b414761611e7b616777b09ad9aa7728",
            "tlsh": "aaf2c6c0a6663c5953066ffbbf2a70d2f66f4989348c4826e9943d1d7cc5232e6f4a31"
        },
        {
            "path": ".ad/xv.js",
            "sha256": "9379c0c2a92309a1ad8fe0236729448c1f95955923c9b8cc475aae826eeebd4f",
            "tlsh": "1ba20980e7c23e95730b1fe7ba1374d2ed5d081a394c8856e6e46d1d3d56722f8e8a30"
        },
        {
            "path": ".ad/xw.js",
            "sha256": "38967965969b01fa73d98952fbd6cc15bf441f8ce33717c4113a0f028c5d7aed",
            "tlsh": "4082c544b2c438d137471fff7613b0e5d488591f786e869af1a87d28bca2626f1da930"
        },
        {
            "path": ".ad/xx.js",
            "sha256": "ee3e244f6067b4acd6c3e7bab0df149e9e8f14ef9a38886df45ebcc77ae1c4eb",
            "tlsh": "01127550b3c27d8067a30fe7b21764c8f22d58d679d84407da59bc285ce2b51e2d9b31"
        },
        {
            "path": ".ad/xy.js",
            "sha256": "ea2df85be2bbf22adf7a82e8048a42aff1a16e6ae0b10bda023964f093420758",
            "tlsh": "1e323e947ec4344e521773ff622a92b0d71988163c5c9f99b4b43c9a3650a2fd3db632"
        },
        {
            "path": ".ad/xz.js",
            "sha256": "dedac0d94d4e1e26031e90c213e5d37e9887a928bb439111a97b27acf326f58b",
            "tlsh": "27822b1653a87490a71ba6ff7a1351c0cd6ba44f778c880ff5d4b8186ab5213f2e5e32"
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/nolimit-agent/MAL-2026-12183.json"