MAL-2026-13945

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/core-js-buffer/MAL-2026-13945.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13945
Published
2026-08-13T17:15:39Z
Modified
2026-08-13T17:30:12.572254303Z
Summary
Malicious code in core-js-buffer (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ec43d0c13a26ec0a6e6dacf51f52a66f48c7dbce7f4a00dbcb72a0749fa6b4e3)

The package's postinstall script (package.json declares "postinstall": "node init.js") performs two hostile actions at install time. First, init.js POSTs installer host and user identifiers — os.hostname(), os.userInfo().username, os.platform(), architecture, Node version, OS release, package name/version, and timestamp — to https://core-js-buffer.domaup-com.workers.dev/report with TLS verification disabled (rejectUnauthorized: false). Second, it fetches an AES-256-GCM encrypted blob from https://core-js-buffer.domaup-com.workers.dev/e, decrypts it with a key derived from a fixed seed, writes the resulting Python code under ~/.cache/core-js-buffer/modules/, and spawns a detached Python process to execute it. Execution is gated by a dev-machine check (presence of Desktop/Documents/Downloads directories) to skip CI/sandbox environments, throttled to at most once per day via a cached marker, and only runs if the decrypted payload contains the string 'TelemetrySender' — evasion controls consistent with a malicious dropper rather than declared telemetry. The package name mimics core-js, a widely used JavaScript polyfill library.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector",
            "sha256": "ec43d0c13a26ec0a6e6dacf51f52a66f48c7dbce7f4a00dbcb72a0749fa6b4e3",
            "id": "IN-MAL-2026-017634",
            "import_time": "2026-08-13T17:24:45.320278313Z",
            "modified_time": "2026-08-13T17:15:39Z"
        }
    ]
}
References
Credits

Affected packages

npm / core-js-buffer

Package

Name
core-js-buffer
View open source insights on deps.dev
Purl
pkg:npm/core-js-buffer

Affected ranges

Affected versions

1.*
1.0.0

Database specific

indicators 
{
    "evidence_files": [
        {
            "path": "init.js",
            "tlsh": "a4a12ff669f2a23032b2f25d826f904aa267f013714aea90f85d76501fdd02c47a5df8",
            "sha256": "d2151c94c8fadefee3ffca12886a08e04e24a3f0cffae2dee54b36e1dbd6274c"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "f278e4914aae0c10806f0af6a2b362730174cd7b",
                "sha512_sri": "sha512-gW3u05kK4etFjmHomZQFF00WZg8cF4Jwqp4XMsUCKIcRyApe/uJdsnSuQ5QJ4Ne+w7+TCVmRQMrUyrEtG+wL2w=="
            },
            "filename": "core-js-buffer-1.0.0.tgz"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/core-js-buffer/MAL-2026-13945.json"
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]