MAL-2026-14242

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/electro-session/MAL-2026-14242.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14242
Published
2026-08-19T04:03:19Z
Modified
2026-08-19T04:30:10.898853746Z
Summary
Malicious code in electro-session (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e7c16137bdd5ac7c97d450fb8ff77103d9c6421f78848b1017f84348c6ec3762)

electro-session@0.1.3 presents itself as 'Session utilities' (~170-byte README) but ships ~1MB of heavily obfuscated JavaScript under dist/ (index.js, cli.js, run-once.js, schedule.js), all produced by javascript-obfuscator (listed in devDependencies) using an RC4-encrypted string array, rotating index accessor, and self-defending/debug-protection wrappers that hide every string, module path, URL, and file path. dist/index.js imports node:sqlite, node:fs, node:os, node:path, node:childprocess, node:crypto and requires./schedule; package.json pins engines.node to >=22.5.0 (the release that introduced the built-in node:sqlite API) and declares @vercel/blob as a runtime dependency. The combination — built-in SQLite reader + childprocess + crypto + a cloud blob upload SDK, wrapped in anti-analysis obfuscation — matches the fingerprint of an infostealer that reads local SQLite-backed credential/session stores (browser Login Data / Cookies / History, wallet extensions, chat app session DBs), decrypts them via childprocess-invoked OS primitives, and uploads them via @vercel/blob. dist/schedule.js (imported by index.js) and the sibling dist/run-once.js implement the standard schedule-plus-payload persistence split via node:childprocess, consistent with registering a recurring OS task (schtasks/cron/launchctl) that re-invokes run-once.js. There are no npm install lifecycle hooks; the payload is triggered when a developer runs the electro-session bin (dist/cli.js prompts a bilingual y/yes/s/si affirmative — English plus Spanish, indicating targeting of Spanish-speaking developers — then constructs new Sessions({...:true,...:true})), or when any module does require('electro-session') and instantiates Sessions (run-once.js does so unconditionally).

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T04:18:13.857647532Z",
            "sha256": "0318ee4ebf490cc9933b403626e354c8f811d4e0a17f150a749bec4e82ed81a3",
            "modified_time": "2026-08-19T04:03:19Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018350",
            "versions": [
                "0.1.1"
            ]
        },
        {
            "import_time": "2026-08-19T04:18:13.893097981Z",
            "source": "amazon-inspector",
            "modified_time": "2026-08-19T04:03:26Z",
            "sha256": "79385dd62edf04b5afdd3a792aa61144b744a155ec930fbb26a4d60aafa02f55",
            "id": "IN-MAL-2026-018351",
            "versions": [
                "0.1.4"
            ]
        },
        {
            "import_time": "2026-08-19T04:18:13.97914218Z",
            "sha256": "e7c16137bdd5ac7c97d450fb8ff77103d9c6421f78848b1017f84348c6ec3762",
            "modified_time": "2026-08-19T04:03:44Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018353",
            "versions": [
                "0.1.3"
            ]
        },
        {
            "import_time": "2026-08-19T04:18:13.956229062Z",
            "sha256": "6c7367e2b048f3145701058ddf8da2ec1cbe515805b83c3bb85efb11a59174a8",
            "modified_time": "2026-08-19T04:03:36Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018352",
            "versions": [
                "0.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / electro-session

Package

Name
electro-session
View open source insights on deps.dev
Purl
pkg:npm/electro-session

Affected ranges

Affected versions

0.*
0.1.0
0.1.1
0.1.3
0.1.4

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/electro-session/MAL-2026-14242.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "9691f92738c66f660de8d5b63e32b8a6563ca2936b36ee40cc13696055c52812",
            "tlsh": "24920f6163d028a0214b8f67771ff5f6e724de9cb5480c8fd0487e54aaa9918efd4e31",
            "path": "dist/cli.js"
        },
        {
            "sha256": "80a8a090f8ef7999840cba719da50310ad433d87c307cc0c0a591cd1107f6872",
            "tlsh": "8f15cda063d0e803204f4f637f0abae4ea1daf7d7544588fd5547da85ab9506caf0af0",
            "path": "dist/index.js"
        },
        {
            "sha256": "4c1efeff4c5c376aa794ee023cffb951088c8c7609ef6b21e95a42eaa430694e",
            "path": "package.json",
            "tlsh": "f401df20da606d7315c8ae952c7852c2a235894755acbc2832e7420c0f5dabb61fe3ed"
        }
    ],
    "package_integrity": [
        {
            "filename": "electro-session-0.1.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-8+Nly+vY6tnfY5m2Qm/AL1yuveswu8sOe6u6ZouC5dRi1cKc0/GphXEp04qn2vHZ4ZkTXQm3mjkAa85ugsHXZA==",
                "sha1": "e57c703f5f1536101d0e5b8adb2fd5627baa37ee"
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]