MAL-2026-13378

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/npm-dc-dev/MAL-2026-13378.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13378
Published
2026-08-05T21:16:31Z
Modified
2026-08-05T22:19:51.093800235Z
Summary
Malicious code in npm-dc-dev (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (91248167ea052dfca231e837bd645444f362dc087be9a7c04f1cf4aeec4d6723)

package.json declares "postinstall": "node test.js". test.js top-level require('.')s index.js and awaits an exported from_str(). index.js consists of a single Function("k4Wmku", "...") invocation whose ~170KB body is encoded with a custom 85-character alphabet and a shuffled string array; standard deobfuscation does not recover the payload. On npm install, the postinstall hook constructs and runs this opaque code on the installer's machine, with child_process, axios, and form-data available as declared dependencies. Package metadata is generic (blank author and description, name npm-dc-dev) and no legitimate library surface is exported. The install-time construction and execution of an unreadable dynamic payload matches the install-time remote-code-execution pattern; no benign reason exists for this shape.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T21:16:31Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-015891",
            "import_time": "2026-08-05T21:31:20.94299478Z",
            "sha256": "91248167ea052dfca231e837bd645444f362dc087be9a7c04f1cf4aeec4d6723",
            "versions": [
                "1.1.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / npm-dc-dev

Package

Name
npm-dc-dev
View open source insights on deps.dev
Purl
pkg:npm/npm-dc-dev

Affected ranges

Affected versions

1.*
1.1.1

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "npm-dc-dev-1.1.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-Rw1pKcLhnfzoYlRp0vCc26zbl3bmqCQYcLnefQiJ4GOREf/1S7+t4cMPd4LpSu7RuzXbB8B4xrizHX5ExMUN3Q==",
                "sha1": "f92838b02a14fb29cbba6611215269a107851d62"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "d8f3cdd8121aa91ff26db504503bdc1a64b3cce8f69cfaf45580e2c87138cb49ae95d7",
            "sha256": "8561e8350f98ddf0dee9966cd077846d558f385cda8bf6d451ef2ec3b24290de",
            "path": "index.js"
        },
        {
            "tlsh": "48e09210cf289a2328c425a41d7e4517b6a28d1b0118bc0c33cf661c8b9d63b24ba65e",
            "sha256": "0c08acce90a5836f00603d2868e4ed98e135b31ffce6afb3011241b0d2e632a0",
            "path": "package.json"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/npm-dc-dev/MAL-2026-13378.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]