MAL-2026-13989

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@secauditb20y/sec-test-r3b/MAL-2026-13989.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13989
Published
2026-08-13T21:23:10Z
Modified
2026-08-13T22:00:13.225198899Z
Summary
Malicious code in @secauditb20y/sec-test-r3b (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (df7034b94531c8be5e9141c7a5cf73f552486c1b307672346a0e646e60207b7c)

package.json declares a postinstall script that runs node -e to invoke fs.writeFileSync, creating /tmp/PWN_R3REAL/FIRED on the installer's machine when the package is installed. The package's main module only exports the literal value 42 and ships no native build or legitimate reason for install-time execution; the postinstall exists solely to demonstrate arbitrary code execution on the installer host at npm install time. The behavior fires automatically on default install and writes to a path outside the package directory, matching the shape of a proof-of-execution beacon. The package name and description self-identify as an authorized security test, but self-labeling is not a mitigation and the code path is functionally identical to a dropper marker.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017707",
            "import_time": "2026-08-13T21:50:19.940159105Z",
            "sha256": "df7034b94531c8be5e9141c7a5cf73f552486c1b307672346a0e646e60207b7c",
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-13T21:23:10Z"
        }
    ]
}
References
Credits

Affected packages

npm / @secauditb20y/sec-test-r3b

Package

Name
@secauditb20y/sec-test-r3b
View open source insights on deps.dev
Purl
pkg:npm/%40secauditb20y/sec-test-r3b

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "package.json",
            "tlsh": "35e07d240e50533338c4467615b6d50a66a1cc2b0004740447c7206951cebb79bbbb0d",
            "sha256": "ab342eb7ca5411389931088dec31d592ac3b5319ccee93b8e50e4ff3bf7f95ad"
        }
    ],
    "package_integrity": [
        {
            "filename": "sec-test-r3b-1.0.0.tgz",
            "hashes": {
                "sha1": "b61fbcce4a59bfae417b8280c35498ea3ff70ed6",
                "sha512_sri": "sha512-qGwpSVqg8lA8Xk6rNsjOSyMPjVn/jFe/6eQlKT0YuQHyIbTsymZn74SAjYqMDeVY8r2ztCjQOU7wS/R5XC6cYA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@secauditb20y/sec-test-r3b/MAL-2026-13989.json"