MAL-2026-14185

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/mutex-thread/MAL-2026-14185.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14185
Published
2026-08-18T23:50:30Z
Modified
2026-08-19T00:30:17.953855485Z
Summary
Malicious code in mutex-thread (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e142539248a690ef78ebe7ceeaa4c16e9903107a04704e1947cf296bce543097)

The package presents itself as a mutex library but lib/Mutex.js contains an injected branch in runExclusive that, when a caller passes callback.meta.jobId === 'cross-chain-transfer', spawns lib/withLoad.min.js as a detached node child with stdio ignored and windowsHide true. lib/withLoad.min.js is a hex/base64-obfuscated dropper that reads an encrypted key from a Sepolia Ethereum smart contract (via eth-sepolia.g.alchemy.com and sepolia.infura.io RPC endpoints), derives a shared secret, decrypts payloads hosted on the contract, writes them to disk, chmods 755, and re-spawns node on them. Before entering its command loop it collects host reconnaissance (os.platform, release, arch, hostname, cpus, totalmem, freemem, uptime) and posts it to a hardcoded Slack bot via slack.com/api/chat.postMessage and to a hardcoded Telegram bot at api.telegram.org/bot<token>/sendMessage. lib/tryLoad.min.d.js polls slack.com/api/conversations.history every ~10 seconds with a hardcoded bearer token and channel id, reassembles chunked messages, AES-GCM-decrypts them using a key passed via argv, writes the plaintext to withLoad.min.js, chmods 755, and spawns node on it; an 'exitexitexit' sentinel triggers self-deletion of loader files and killing of a peer PID. String-array rotation and base64 wrapping are used to hide C2 hosts, bot tokens, channel ids, and the Sepolia contract address.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T00:21:10.94968594Z",
            "sha256": "e142539248a690ef78ebe7ceeaa4c16e9903107a04704e1947cf296bce543097",
            "modified_time": "2026-08-18T23:50:30Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018228",
            "versions": [
                "1.3.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / mutex-thread

Package

Name
mutex-thread
View open source insights on deps.dev
Purl
pkg:npm/mutex-thread

Affected ranges

Affected versions

1.*
1.3.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/mutex-thread/MAL-2026-14185.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "d26e78a6950438cc186905e8d64bf620da5954e1ab42e13150b538a29406fe3e",
            "tlsh": "6541a28467f395161233b0dac76b8005b17c8027024cc9a5f94dd1ea6f5506ccbe5bbd",
            "path": "lib/Mutex.js"
        },
        {
            "sha256": "9bffc4afc9e892a6ba29864f4ced4804bb884d1e425003422c8fdd97256ef490",
            "tlsh": "67421acdfb98353603d6b89e92586c87c5998ca2572dc600fa89dd8f305e3d095a3f78",
            "path": "lib/withLoad.min.js"
        },
        {
            "sha256": "b7af51bfbb90d738ced23d3b07212125565919224e747ba8a353cd815ec11845",
            "tlsh": "c7a1e9cd9fad3c760fd60466a49621030a79fc9aaa087190e545cbdd3f59b8051c3ff5",
            "path": "lib/tryLoad.min.d.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "mutex-thread-1.3.0.tgz",
            "hashes": {
                "sha1": "7524fe0df37fcea71c860fb662f4890b51a98e9f",
                "sha512_sri": "sha512-tf0sGByl7nz8dTiMLzSQTQ862radlBj+7MqZPxiQ8TflALw6mlQqLPXN7IgjcIwKZlElk3+hMgRT9w3Mlk2MAg=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]