MAL-2026-13360

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/uzair-rajput-new/MAL-2026-13360.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13360
Published
2026-08-05T17:38:18Z
Modified
2026-08-05T18:19:47.691982636Z
Summary
Malicious code in uzair-rajput-new (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (70070ac11c08aa4d23d214d9539b96f97c6bd6eaa56bb6561160d02bd6d52632)

The CJS entry (dist/index.cjs) assembles a scrypt password by XOR-deobfuscating three sibling byte arrays (_a.cjs, _b.cjs, _c.cjs) with distinct constants (17, 91, 53), uses that key with createDecipheriv('aes-256-cbc',...) to decrypt an embedded ~5KB ciphertext, and passes the plaintext to new Function('module','exports','require','__dirname','__filename',...)(...) — executing opaque code in the consumer's Node process on every require('uzair-rajput-new'). The parallel ESM build (dist/index.js) is a plain color-gradient library containing no such loader, so the obfuscated dynamic-code loader is not a legitimate transpilation artifact of the declared TypeScript source. The split-key layout, XOR obfuscation of key material, and AES-encrypted payload together constitute an anti-analysis packaging pattern whose only effect is to hide arbitrary code executed at module load.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-05T18:07:51.171790787Z",
            "modified_time": "2026-08-05T17:38:18Z",
            "sha256": "70070ac11c08aa4d23d214d9539b96f97c6bd6eaa56bb6561160d02bd6d52632",
            "id": "IN-MAL-2026-015838",
            "versions": [
                "1.0.1"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / uzair-rajput-new

Package

Name
uzair-rajput-new
View open source insights on deps.dev
Purl
pkg:npm/uzair-rajput-new

Affected ranges

Affected versions

1.*
1.0.1

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-+11JQNfleMzuhHqgU9nYTD2cLVCe0j2q+4TqD6Fn5w1dwhW6Xqvi9SmqYKhzk/F0rblaJ0WpGj389eJHBjBijw==",
                "sha1": "9ceb68689aa14def50104f5cf39cc00d5940825e"
            },
            "filename": "uzair-rajput-new-1.0.1.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "dist/index.cjs",
            "sha256": "3f564f0df5a16009ca450256e3e5e0457dcd9202e10f79567b7b2aa354d888b2",
            "tlsh": "f1f1ae461cbe00a6f8bac1b27932e14d1df5dbb4345f940a06ca9eca449661e90f0b1d"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/uzair-rajput-new/MAL-2026-13360.json"