MAL-2026-12514

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/async-mutex-v3/MAL-2026-12514.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-12514

Published

2026-08-05T13:13:00Z

Modified

2026-08-05T14:35:13Z

Summary

Malicious code in async-mutex-v3 (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (699abe52cb380ae997f200e0615bfce84cd52d11b98a54244ce5b30478fab336)

Package name typosquats async-mutex but ships unrelated functionality. The default export getPlugin in index.js issues an HTTP request to a hardcoded bare IP endpoint (http://46.183.25.232:45000/icons/108) and passes the response's credits field into new Function('require','module',...,'Promise', data.credits), executing attacker-controlled JavaScript with Node privileges (access to require, process, Buffer). Cover-story variable names (IconProvider, iconDomain referencing cloudflare/fastly/akamai/gcore, path /ajax/libs/font-awesome/..., header bearrtoken: 'logo') frame the code as an icon CDN helper, while the actually-used path hits the bare IP. Declared dependencies (better-sqlite3, @primno/dpapi, node-machine-id) are consistent with a credential-stealer post-exploitation pipeline. Any consumer that requires this package and invokes the default export executes whatever JavaScript the remote server returns.

Database specific

{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-014928",
            "import_time": "2026-08-05T14:19:43.859834756Z",
            "modified_time": "2026-08-05T13:13:00Z",
            "sha256": "699abe52cb380ae997f200e0615bfce84cd52d11b98a54244ce5b30478fab336",
            "source": "amazon-inspector",
            "versions": [
                "3.1.0"
            ]
        }
    ]
}

References

https://www.npmjs.com/package/async-mutex-v3/v/3.1.0

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com

Affected packages

npm / async-mutex-v3

Package

Name: async-mutex-v3; View open source insights on deps.dev
Purl: pkg:npm/async-mutex-v3

Affected ranges

Affected versions

3.*

3.1.0

Database specific

cwes

[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]

indicators

{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "ce2c680ca6b7355d73cbc131465fc6b2f2508f367b57ecb27a3b05e6e247213f",
            "tlsh": "30c1616546fa31a36a67e4eef30f10027165e313365de971f48e42902fca568e5f24e8"
        }
    ],
    "package_integrity": [
        {
            "filename": "async-mutex-v3-3.1.0.tgz",
            "hashes": {
                "sha1": "f4adff48d931d29fc8bd875bab153d0cf039bbe2",
                "sha512_sri": "sha512-5gHn8hGVKY84Z+ldKvzIGUrxshf6miV5VMmXSZAsH+smtNWJZNKlOpmt9asxDfQ3fMKLIYm5ySf79mhQfcENbQ=="
            }
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/async-mutex-v3/MAL-2026-12514.json"