MAL-2026-14046

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@ghost_debugger/nanocache/MAL-2026-14046.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14046
Published
2026-08-14T19:22:27Z
Modified
2026-08-14T19:30:11.664604036Z
Summary
Malicious code in @ghost_debugger/nanocache (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c027fa29f4577bd052bfda553a617994365ea5855216b877e900610542f4bcce)

On require/import, the package spawns a bundled 1.1 MB Windows executable at vendor/nanocache.exe as a detached background process with stdio ignored, windowsHide set, and child.unref() so it survives parent exit. The declared purpose is an in-memory LRU+TTL cache, which does not require a native background process, and the binary is not built from source shipped in the tarball. Strings inside the executable include /ws/agent, disconnect, update, and exit_code, consistent with a WebSocket-based remote agent that accepts commands from a remote controller. The README further describes vendor/nanocache.exe as a drop-in slot for an arbitrary Windows executable, indicating the npm module functions as a generic launcher for the bundled binary. Installing or importing the package on a Windows host results in an opaque, hidden native process being launched under a cache-library cover story, giving a remote party persistent control over the installer's machine.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017917",
            "import_time": "2026-08-14T19:24:34.333515532Z",
            "sha256": "c027fa29f4577bd052bfda553a617994365ea5855216b877e900610542f4bcce",
            "modified_time": "2026-08-14T19:22:27Z",
            "source": "amazon-inspector",
            "versions": [
                "0.1.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @ghost_debugger/nanocache

Package

Name
@ghost_debugger/nanocache
View open source insights on deps.dev
Purl
pkg:npm/%40ghost_debugger/nanocache

Affected ranges

Affected versions

0.*
0.1.1

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "dist/index.cjs",
            "tlsh": "0402a74937f722991db211f63f1ba043b72c402b1246dda4baac43bc6f8167542f59b9",
            "sha256": "749efc05d8690b246bbb05c75392f1ee8907493293387f9dc703b792349c5319"
        },
        {
            "path": "vendor/nanocache.exe",
            "tlsh": "ad454c17e2a345fcc56bc1b4965787b2b970b8694234bd6e1e94d3322f23e504f2eb24",
            "sha256": "656eccdd2123d3e44bb8d961d1b75154dedbf9a9a66dd7569f3176e3a78acdb4"
        },
        {
            "path": "README.md",
            "tlsh": "0bc1737a3f0203352db7d2b5379e72e2ef25521e271268e4786d56bd230629c40be9d2",
            "sha256": "3f898e24a7a0894f9b4cb3460a8c69626e9d5c67c4a17ed4aefd04dc869c1100"
        }
    ],
    "package_integrity": [
        {
            "filename": "nanocache-0.1.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-oQu9wQoHagw0l7pq5AmYaAuhiEwQaegynom7ht7bVHohoNoeEq0Ji3twFgMMvc+eNRZZxKAOFDTJvn1MI2bXjA==",
                "sha1": "1e612a2d650cb42b4065f034a68a7d37863e1c08"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@ghost_debugger/nanocache/MAL-2026-14046.json"