MAL-2026-12331

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@wololasod/tiny-id/MAL-2026-12331.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12331
Published
2026-08-05T12:50:23Z
Modified
2026-08-05T13:34:53.356876338Z
Summary
Malicious code in @wololasod/tiny-id (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5b3ca8617b237bb3d8fd7d14aa18554118397e7b7faaea2e87cdd8433fef7a8f)

The package advertises itself as a tiny ID generator but its main entry dist/index.cjs contains an obfuscator.io + RC4 string-array VM that, on require/import, resolves a platform-specific configuration (win32/linux), downloads a remote executable over https to a temp/APPDATA path, and executes it via childprocess.spawn (VBS launcher on Windows, direct spawn on Linux), then deletes the staged file. Staging filename observed: 'nupkgsystem.diagnostics.performancecounter.8.0.0.py'. The loader additionally re-launches itself via spawn(process.execPath, [__filename], {detached:true, stdio:'ignore', windowsHide:true, env:{...process.env, RUNPAYLOAD:...}}) and unrefs the child, producing a hidden, detached process that survives the parent. The loader includes obfuscator.io anti-analysis features: RC4-decoded string array, hex-named identifiers, eval.toString()/Function.prototype.bind.toString() '[native code]' integrity checks, and a djb2 caller-hash gate ('$h!== 0x74F28336') that crashes if the code is reformatted. The same obfuscated dropper is also shipped in dist/index.d.ts, which is declared as the TypeScript types entry — a.d.ts file should contain pure type declarations, not executable code. None of this behavior relates to ID generation.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "4b86e785db5111f091312c26dc471a90839c0785a4989f25065555c82c64dd76",
            "import_time": "2026-08-05T13:08:46.144725876Z",
            "modified_time": "2026-08-05T12:50:39Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-014783",
            "versions": [
                "0.1.1"
            ]
        },
        {
            "source": "amazon-inspector",
            "import_time": "2026-08-05T13:08:46.205758778Z",
            "modified_time": "2026-08-05T12:50:49Z",
            "sha256": "5b3ca8617b237bb3d8fd7d14aa18554118397e7b7faaea2e87cdd8433fef7a8f",
            "id": "IN-MAL-2026-014784",
            "versions": [
                "0.1.3"
            ]
        },
        {
            "sha256": "84d9d02380d22d1874c6948d91ef38033e2f7ebfb233a89c1e1b3f4cc2bc6ef9",
            "import_time": "2026-08-05T13:08:45.957063598Z",
            "modified_time": "2026-08-05T12:50:23Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-014781",
            "versions": [
                "0.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @wololasod/tiny-id

Package

Name
@wololasod/tiny-id
View open source insights on deps.dev
Purl
pkg:npm/%40wololasod/tiny-id

Affected ranges

Affected versions

0.*
0.1.0
0.1.1
0.1.3

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@wololasod/tiny-id/MAL-2026-12331.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "ebf890ffdd3dda2776a0e514a87b7a274578457b8e902c0d1cbc088444a378f9",
            "tlsh": "a4a1f85fb3f272a653db0259b07f6204dbbb4675040e0118f118849a38a06b993f3fb9",
            "path": "dist/index.cjs"
        },
        {
            "sha256": "a17694583d51c6672704f738163d9e9cc225390b2a14588a591a5974814c4389",
            "tlsh": "dee1a9612cb6b12306f2d2b4dbd29919e51741232322419efdfca3512f3312d926dfda",
            "path": "dist/index.d.ts"
        }
    ],
    "package_integrity": [
        {
            "filename": "tiny-id-0.1.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-5XUh+yuObKsYq3MOa6Pe66f1jvatX+5lDc27M9LeNVW58H7yNZxOafUtUJqe41m/rlDjc4Kqf70ur8OgLNTSrQ==",
                "sha1": "133a08f5b143356d793ab87acd1710140365cc4b"
            }
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]