MAL-2026-13956

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/npm-hex-utils/MAL-2026-13956.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13956
Published
2026-08-13T17:17:04Z
Modified
2026-08-13T17:30:11.190965591Z
Summary
Malicious code in npm-hex-utils (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (6a0f1f9004b6a502c144d4d475e89a3956905aebf51fb2696d4ba05c21613727)

The package's postinstall runs runtime.js, which POSTs os.hostname(), os.userInfo().username, os.platform()+os.arch(), Node version, and OS release to https://steel-mere-4155.ricardorichp.workers.dev/report, then fetches an encrypted blob from https://steel-mere-4155.ricardorichp.workers.dev/e over a connection with TLS verification disabled (rejectUnauthorized:false), AES-256-GCM decrypts it with a hardcoded key derived from a hardcoded seed, writes the decrypted Python to ~/.cache/hex-encode-utils/modules/runtime.py, and spawns python detached with stdio ignored to execute it. Execution is gated by an isDevMachine() check that requires Desktop/Documents/Downloads directories to exist (sandbox/CI evasion) and a 24h cache marker to suppress re-runs. Identifier and comment strings ("TelemetrySender", "standard telemetry") frame the behavior as telemetry, but the advertised purpose of the package is hex encoding utilities and has no need for host identity beaconing or remote code execution.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-13T17:17:04Z",
            "versions": [
                "1.1.1"
            ],
            "sha256": "6a0f1f9004b6a502c144d4d475e89a3956905aebf51fb2696d4ba05c21613727",
            "id": "IN-MAL-2026-017644",
            "import_time": "2026-08-13T17:24:45.77248614Z"
        }
    ]
}
References
Credits

Affected packages

npm / npm-hex-utils

Package

Name
npm-hex-utils
View open source insights on deps.dev
Purl
pkg:npm/npm-hex-utils

Affected ranges

Affected versions

1.*
1.1.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/npm-hex-utils/MAL-2026-13956.json"
indicators 
{
    "evidence_files": [
        {
            "path": "runtime.js",
            "sha256": "c2f7b2f01fe7ce17dbe92874742967a420968d1e6f6a15fff53682867acd89f8",
            "tlsh": "18b120f669f2a2613673f29ec36fa046a267f0133109ea50f89d32511fdd06c0665ef8"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "ea7ba4c5dca366579ef41f66d8ba29c746d90120",
                "sha512_sri": "sha512-Qajp2JwGOQDtccsxgCfmZ/NolUnpcVXZ6jUo5534isthf0x9KcaP0APWdbj1z1WqpbXOT3mWZ2gt2Nyfu34Gjg=="
            },
            "filename": "npm-hex-utils-1.1.1.tgz"
        }
    ]
}