MAL-2026-12359

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/crypto-javas/MAL-2026-12359.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12359
Published
2026-08-05T12:59:52Z
Modified
2026-08-19T04:30:10Z
Summary
Malicious code in crypto-javas (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (75003e4aab1668c5d9b7f1216e6b356473ebb6e834da3a015e920807e8717ed9)

The package's postinstall hook runs setup.js, which enumerates process.env (excluding only a small OS blocklist for PATH/HOME/USER/SHELL/LANG), collects every remaining variable's value together with CI job metadata (CI_JOB_ID, GITHUB_RUN_ID, project, commit, branch, hostname), and HTTPS-POSTs the payload to a URL and API key read from BACKEND_URL/BACKEND_API_KEY, package.json.crypto-javas.backend,.crypto-config.json, or.env in the current working directory. The declared main entrypoint index.js additionally invokes autoExecute() at module top level, instantiating SecretsHandler.readFromEnvironment and sendToBackend so that every require/import of the package re-runs the same environment-variable harvest and POST. The behavior is undisclosed in the README, which presents the package as @wizlabs/js-crypto (a typosquat-style mismatch with the actual name crypto-javas); repository is the placeholder gitlab.com/example/js-crypto and author is a generic DevSecOps handle. In a CI runner this ships AWS_*, GITHUB_TOKEN, NPM_TOKEN, CI_JOB_TOKEN and any other pipeline secrets to an attacker-configurable backend.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-014845",
            "import_time": "2026-08-05T13:08:50.699774169Z",
            "modified_time": "2026-08-05T13:00:35Z",
            "sha256": "51ea78569a1330ed6c2019a0260ba5e128339c2a1d0b42489d2e84c0408a11e6",
            "source": "amazon-inspector",
            "versions": [
                "2.0.4"
            ]
        },
        {
            "id": "IN-MAL-2026-014843",
            "import_time": "2026-08-05T13:08:50.586702792Z",
            "modified_time": "2026-08-05T13:00:15Z",
            "sha256": "5a8df6a7a735756b97bf8957dfacf2076f6ea39d4fdc8489755ea14e8c89f9c1",
            "source": "amazon-inspector",
            "versions": [
                "2.0.7"
            ]
        },
        {
            "id": "IN-MAL-2026-014840",
            "import_time": "2026-08-05T13:08:50.386658131Z",
            "modified_time": "2026-08-05T12:59:52Z",
            "sha256": "fe1460442a480b91392f6b6b9fde9b5933acca5be28ddd4fc96578099f98e8d5",
            "source": "amazon-inspector",
            "versions": [
                "2.0.8"
            ]
        },
        {
            "id": "IN-MAL-2026-018346",
            "import_time": "2026-08-19T04:18:13.727478259Z",
            "modified_time": "2026-08-19T04:01:06Z",
            "sha256": "5fa838fd808c704b14402aca651c52728f92837bcfb94ce9085c692a5324dd1e",
            "source": "amazon-inspector",
            "versions": [
                "2.0.9"
            ]
        },
        {
            "id": "IN-MAL-2026-018347",
            "import_time": "2026-08-19T04:18:13.75704855Z",
            "modified_time": "2026-08-19T04:01:14Z",
            "sha256": "75003e4aab1668c5d9b7f1216e6b356473ebb6e834da3a015e920807e8717ed9",
            "source": "amazon-inspector",
            "versions": [
                "2.0.6"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / crypto-javas

Package

Name
crypto-javas
View open source insights on deps.dev
Purl
pkg:npm/crypto-javas

Affected ranges

Affected versions

2.*
2.0.4
2.0.6
2.0.7
2.0.8
2.0.9

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "setup.js",
            "sha256": "fee2025c686373d93d0e8ad23deb2e27d9b6eca290b81c8bdc45177c47ef802b",
            "tlsh": "69b1970645fd64020b63565d67af6212bb75f5032e08fe54bbcd23062f5a22d87f26ec"
        },
        {
            "path": "index.js",
            "sha256": "bff36808e1f67efa2d0633861a0673a5f0da627dcb3095d1c79c7a9b967642d8",
            "tlsh": "60e1a609a5fe64028ba3615e3bdf7202b635e9071e08fe54bacc13455f4a12d8bf17e8"
        },
        {
            "path": "package.json",
            "sha256": "2de99cd8f9fad8c0837133b8cfc2d082676d6fab78f69c56b9cf9fc8845e4e90",
            "tlsh": "47f04c24c8346c633ac85b559d7a0445a4308e174e487c0d33e7522c8f9e2af24ff7ad"
        }
    ],
    "package_integrity": [
        {
            "filename": "crypto-javas-2.0.4.tgz",
            "hashes": {
                "sha1": "697a763c51887a9be194e365095951ed4413ef2c",
                "sha512_sri": "sha512-OrnuMW6KyalattYkYhUmTRg2W1LCSc6YpuFuGjiLSKmYwDBFxhBIKlaY30EXCB4Yh17ENrC6lmlJgHIXDaeUhA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/crypto-javas/MAL-2026-12359.json"