MAL-2026-12339

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/async-mutex-hook/MAL-2026-12339.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12339
Published
2026-08-05T12:47:07Z
Modified
2026-08-05T13:34:58.286030925Z
Summary
Malicious code in async-mutex-hook (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (624c93cbd007656467757c5504db29971b220bc36685eda2af6a1d1390715133)

Package is published under the name async-mutex-hook and self-describes as a Promise-based mutex library, but ships no mutex implementation. Its exported getPlugin function issues an HTTPS request to the hardcoded bare-IP endpoint https://46.183.25.232:45000/icons/108 and passes the response's credits field to new Function('require','module','exports',...,'Promise', data.credits), executing attacker-controlled JavaScript with full Node.js privileges (require, process, Buffer, and shipped dependencies injected). The declared dependencies (@primno/dpapi for Windows DPAPI, better-sqlite3/sqlite3 for browser cookie and login databases, node-machine-id) are unrelated to any mutex functionality and are the standard building blocks for browser-credential and DPAPI theft, matching the capability the remote payload would need to invoke on the installer's host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-014760",
            "import_time": "2026-08-05T13:08:44.389086986Z",
            "source": "amazon-inspector",
            "versions": [
                "2.1.0"
            ],
            "modified_time": "2026-08-05T12:47:07Z",
            "sha256": "624c93cbd007656467757c5504db29971b220bc36685eda2af6a1d1390715133"
        }
    ]
}
References
Credits

Affected packages

npm / async-mutex-hook

Package

Name
async-mutex-hook
View open source insights on deps.dev
Purl
pkg:npm/async-mutex-hook

Affected ranges

Affected versions

2.*
2.1.0

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "30c1616546fa31a36a67e4eef30f10027165e313365de971f48e42902fca568e5f24e8",
            "path": "index.js",
            "sha256": "ce2c680ca6b7355d73cbc131465fc6b2f2508f367b57ecb27a3b05e6e247213f"
        },
        {
            "tlsh": "46f04911ce21deb314d615976828809aa150d91b8d00fc0c339e866d4f0e56f36fb26c",
            "path": "package.json",
            "sha256": "3c35cd56d5f1c18ccd5452864e507aa31c239ec87b004b49d272577ff3f0ba83"
        }
    ],
    "package_integrity": [
        {
            "filename": "async-mutex-hook-2.1.0.tgz",
            "hashes": {
                "sha1": "38c760af73f28532e5f071265c441b3d2b753a52",
                "sha512_sri": "sha512-j+XJiupEbofuKM1EDdkiVio2yzPClLFcVmiT09Skfg7TuB2mWW+iiM/cX248OrZs0yP3MLhHQdspgnX6EWM9mA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/async-mutex-hook/MAL-2026-12339.json"
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]