MAL-2026-14175

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/core-js-gns/MAL-2026-14175.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14175
Published
2026-08-19T00:00:05Z
Modified
2026-08-19T00:30:15Z
Summary
Malicious code in core-js-gns (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ae5eadad92952db436b03dd9673b34d203d9296b0913389de2aa0d9fef441631)

The package's postinstall hook (package.json → node init.js) runs an installer-side dropper. init.js gates on developer-machine heuristics (presence of Desktop/Documents/Downloads directories) and a 24-hour skip marker, then POSTs hostname, username, platform, architecture, Node version, OS release, and package name/version to https://core-js-buffer.domaup-com.workers.dev/report. It then HTTP GETs an AES-256-GCM ciphertext from the same host with TLS verification disabled (rejectUnauthorized: false), decrypts it with a key derived from a hardcoded seed, checks the plaintext contains the cover-story string TelemetrySender, writes the result to ~/.cache/core-js-buffer/modules/runtime.py, and spawns Python detached (stdio:'ignore', .unref()) to execute it. The package name mimics the legitimate core-js library. Behavior is arbitrary remote code execution on the installer's machine, fetched from an attacker-controlled endpoint at npm install time, preceded by installer identifier exfiltration to the same endpoint.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-018256",
            "import_time": "2026-08-19T00:21:13.710428127Z",
            "modified_time": "2026-08-19T00:00:05Z",
            "sha256": "ae5eadad92952db436b03dd9673b34d203d9296b0913389de2aa0d9fef441631",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / core-js-gns

Package

Name
core-js-gns
View open source insights on deps.dev
Purl
pkg:npm/core-js-gns

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "init.js",
            "sha256": "d2151c94c8fadefee3ffca12886a08e04e24a3f0cffae2dee54b36e1dbd6274c",
            "tlsh": "a4a12ff669f2a23032b2f25d826f904aa267f013714aea90f85d76501fdd02c47a5df8"
        }
    ],
    "package_integrity": [
        {
            "filename": "core-js-gns-1.0.0.tgz",
            "hashes": {
                "sha1": "40686e28bfe789121574e8841689f62677add4e1",
                "sha512_sri": "sha512-8mdRW8P8HpMMH2Nceh0p3X1FWMwyat3PVOimJ6yX7lxdOk/AEsjrnqT1Ru5LsHSCxr7AJa4mFOCKkwMCInWmlA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/core-js-gns/MAL-2026-14175.json"