MAL-2026-13736

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@nzeros/codebreak/MAL-2026-13736.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13736
Published
2026-08-11T15:26:15Z
Modified
2026-08-11T15:32:27.749966048Z
Summary
Malicious code in @nzeros/codebreak (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (cf2d80dd4a014bd04f0f01ef666cc4a6a09bb010a37e572a0eb9a3e0298ed5fe)

The package declares native/solver.c as the source of a small C minimax solver and advertises vendor/solver-<platform>-<arch> as its compiled output. The darwin-arm64 slot contains a ~34KB Mach-O consistent with that C source, but vendor/solver-darwin-x64 and vendor/solver-linux-x64 are identical 33,648,788-byte Linux ELF Go binaries (same sha256 05b69666...4420) that link net/http, os/exec, crypto/chacha8, and reference /proc/self/. The postinstall script invokes spawnSync(BINARY, ['selftest']) on install, so on Linux x64 hosts the shipped opaque Go binary runs automatically at install time. The binary's linked packages (network client, process execution, symmetric crypto) and ~1000x size inflation over any plausible build of the declared C algorithm are inconsistent with the documented purpose, and the darwin-x64 slot being populated with a Linux ELF further indicates the vendor tree was not built from the shipped C source. The install-time execution path against unverified, purpose-mismatched bytes on Linux x64 is a fetch-and-execute equivalent embedded in the tarball rather than downloaded, and the destination of any network activity performed by the Go binary cannot be determined from strings alone.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017370",
            "import_time": "2026-08-11T15:26:49.383297144Z",
            "sha256": "cf2d80dd4a014bd04f0f01ef666cc4a6a09bb010a37e572a0eb9a3e0298ed5fe",
            "versions": [
                "1.3.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-11T15:26:15Z"
        }
    ]
}
References
Credits

Affected packages

npm / @nzeros/codebreak

Package

Name
@nzeros/codebreak
View open source insights on deps.dev
Purl
pkg:npm/%40nzeros/codebreak

Affected ranges

Affected versions

1.*
1.3.0

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "vendor/solver-linux-x64",
            "tlsh": "43773a47e8e21a94c4aac670d525816bbbb13c4d2b7c23eb1790f3702f36bd06a76751",
            "sha256": "05b69666193e8fa719c37df22833bf36a120b15e2408a9ecd47e34f140a44420"
        },
        {
            "path": "vendor/solver-darwin-x64",
            "tlsh": "43773a47e8e21a94c4aac670d525816bbbb13c4d2b7c23eb1790f3702f36bd06a76751",
            "sha256": "05b69666193e8fa719c37df22833bf36a120b15e2408a9ecd47e34f140a44420"
        }
    ],
    "package_integrity": [
        {
            "filename": "codebreak-1.3.0.tgz",
            "hashes": {
                "sha1": "962691f45a73c96d349d37f902f8360ef5457220",
                "sha512_sri": "sha512-K2TbeRuTxuuNf2HM13a8NOnfNaLRlUDMBtcfWy5ywU054MZ8glQEjfkI/2r/dKjVH9KWFxsdNJbDEcaF5w/yOw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@nzeros/codebreak/MAL-2026-13736.json"