MAL-2026-12422

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/quorvex/MAL-2026-12422.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12422
Published
2026-08-05T12:25:31Z
Modified
2026-08-05T14:37:18.121772722Z
Summary
Malicious code in quorvex (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (9127b24fd8619b810163b5b5714d580951a3a96cfa1b37e63a57ff3cc9c2cca5)

quorvex@0.2.1 ships index.mjs as the package main, containing a base64-encoded Windows PE (~355KB) in a PAYLOAD constant. At import time on Windows hosts with more than 4GB of RAM, the code decodes the payload and writes it to %APPDATA%/Microsoft/Windows/Start Menu/Programs/Startup/vite-native-helper.exe, causing Windows to auto-execute the dropped binary at the next user logon. The README self-describes the package as a placeholder with 'nothing in here yet' while documenting deliberate anti-tree-shaking design ('index.mjs performs a real import-time assignment... that no bundler can prove is inert') to ensure the drop runs when the module is loaded. The vite-native-helper.exe filename and Vite-adjacent naming are a cover story; the memory-size gate is a sandbox-evasion check. Installing or importing this package on a Windows host results in an opaque attacker-controlled binary being placed in the user's Startup folder with logon-time persistence.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-05T13:08:33.893348413Z",
            "sha256": "9127b24fd8619b810163b5b5714d580951a3a96cfa1b37e63a57ff3cc9c2cca5",
            "modified_time": "2026-08-05T12:25:31Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-014650",
            "versions": [
                "0.2.1"
            ]
        },
        {
            "import_time": "2026-08-05T14:19:49.610566067Z",
            "sha256": "eb2613921a1fac2ba390b1d8e9795123284ad6a873544568b263e533c51ab152",
            "modified_time": "2026-08-05T13:38:22Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-014987",
            "versions": [
                "0.2.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / quorvex

Package

Name
quorvex
View open source insights on deps.dev
Purl
pkg:npm/quorvex

Affected ranges

Affected versions

0.*
0.2.0
0.2.1

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/quorvex/MAL-2026-12422.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "3909d912213d84a44da8973384e853afcc6b3e7eff787400a0dac5068dcfbc9c",
            "path": "index.mjs",
            "tlsh": "32746c72121bfcaa2aec2d80d0012d541e6d2e474624b165ebcbb0fa53ed557cd3d9bc"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]