MAL-2026-14162

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/axious-core/MAL-2026-14162.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14162
Published
2026-08-18T23:56:13Z
Modified
2026-08-19T00:30:11.448739926Z
Summary
Malicious code in axious-core (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (da16d1b32b464ea73dcd68b2fbf9f3b80519453c19402d29de3bc86d79bc5d25)

axious-core has an empty index.js and no declared functionality, but its scripts/postinstall.js runs a full install-time dropper. Four opaque byte arrays are XOR-decoded at runtime with the key 'stf2026' to reconstruct a download URL and shell command. The decoded URL points to github.com/bebraz1/... which is fetched to %TEMP%\main.exe and spawned detached with stdio ignored and windowsHide. When executed on WSL/Linux (detected by reading /proc/version and WSL environment variables), a second XOR-decoded bridge command is used to launch the downloaded Windows binary from inside the Linux environment via PowerShell/WSL interop. In parallel, sendInstallMetrics POSTs a JSON payload containing the host platform to a bare IPv4 destination assembled from an array literal ('193','70','34','101').join('.') at 193.70.34.101:20099/vote — an install-success beacon to attacker-controlled infrastructure, with the IP hidden via array join to evade static scanners. The combination of an empty library facade, XOR-obfuscated URLs and shell commands, an unverified remote binary drop-and-execute on install, a WSL escape path, and a bare-IP C2 beacon is a supply-chain dropper.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T00:21:11.145636263Z",
            "source": "amazon-inspector",
            "modified_time": "2026-08-18T23:56:13Z",
            "sha256": "da16d1b32b464ea73dcd68b2fbf9f3b80519453c19402d29de3bc86d79bc5d25",
            "id": "IN-MAL-2026-018230",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / axious-core

Package

Name
axious-core
View open source insights on deps.dev
Purl
pkg:npm/axious-core

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/axious-core/MAL-2026-14162.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "03932677c22fab9046a2581f609f0ace77920a8bb196edd069d82cfc5cf8a529",
            "path": "scripts/postinstall.js",
            "tlsh": "c6d13fca1ef59034834bf96884cf9d13b2a6c207320d4a65ff8f42107f5793c85a69e9"
        }
    ],
    "package_integrity": [
        {
            "filename": "axious-core-1.0.0.tgz",
            "hashes": {
                "sha1": "80a28ba3601615a0410af129b328c7bc2bdcd0ab",
                "sha512_sri": "sha512-gU8uaQF2aa3nef2lOmB/kMRE9oOaDLm0R5z6wlv97/rygclEXs68R4dwtTgt6GyMX/O537aKy0VVuW2cHY4IXQ=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]