MAL-2026-14187

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/raectjs/MAL-2026-14187.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14187
Published
2026-08-18T23:59:57Z
Modified
2026-08-19T00:30:14.475612381Z
Summary
Malicious code in raectjs (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f75a611c33224c779330b8d5313702dc44f20d197dd96f62fb236982281b9d09)

scripts/postinstall.js runs on npm install and performs two attacker-beneficial actions. First, it POSTs a JSON platform snapshot to the hardcoded bare-IP endpoint http://193.70.34.101:20099/vote, with the host string reconstructed at runtime by joining ['193','70','34','101'] to evade static hostname matching. Second, it XOR-decodes (key 'stf2026') an embedded byte array (ADDONENC) into a URL pointing at a GitHub releases/download/.../main.exe under an attacker-controlled account, fetches the payload into %TEMP%\main.exe, and spawns it detached with stdio:'ignore' and windowsHide:true. On WSL/virtualized Linux it XOR-decodes a PowerShell bridge command and script (BRIDGELAUNCHERENC, BRIDGESCRIPTPREENC, BRIDGESCRIPTPOST_ENC) to invoke the same payload on the Windows host. The fetched binary has no pinning, no hash or signature verification, and the package name uses a cover story ('addon', 'TELEMETRY.addon') while shipping no native source consistent with a real addon (index.js exports {}). Package has no legitimate purpose beyond delivering the dropper.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T00:21:13.617942599Z",
            "sha256": "f75a611c33224c779330b8d5313702dc44f20d197dd96f62fb236982281b9d09",
            "modified_time": "2026-08-18T23:59:57Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018255",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / raectjs

Package

Name
raectjs
View open source insights on deps.dev
Purl
pkg:npm/raectjs

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/raectjs/MAL-2026-14187.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "4f512d415af57f24a4bddc03c85da557c1b8c78ad054cadca3a9b73e4442b034",
            "path": "scripts/postinstall.js",
            "tlsh": "17d13fc61ef59035874bf96884cf9d13b2a6c207330e4a65fb8f42107f5792c85a69d6"
        }
    ],
    "package_integrity": [
        {
            "filename": "raectjs-1.0.0.tgz",
            "hashes": {
                "sha1": "7c78e6639b7fba51c644f24e03d72ad84b34bd27",
                "sha512_sri": "sha512-s0WGn4q3qY4lCxl63sdzMmmERnKlnn0XyYjxS5wUlRIyTaGm/NRAAw4hItE0cxA/Hd2/DyQb+rrqiuBuo9k0eg=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]