MAL-2026-14248

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/nice-utils-helper/MAL-2026-14248.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14248
Published
2026-08-19T04:18:04Z
Modified
2026-08-19T04:30:10.948351649Z
Summary
Malicious code in nice-utils-helper (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5c88734e4d701b61fd197a942bc057f59c684d4eb9994ca0efc7136dfcf893c9)

The npm package nice-utils-helper@1.0.0 executes probe.js from its postinstall lifecycle. On install, probe.js issues requests to cloud instance-metadata service endpoints (AWS 169.254.169.254, Aliyun 100.100.100.200, Tencent metadata.tencentyun.com, 169.254.0.23) using curl/http.request/GET and records per-target reachability along with the host's hostname and cwd. It then writes NCODEMETA.txt and NCODEPOC_MARKER.txt into the current directory as well as../ and../.., leaving beacon/marker artifacts above the package root. The package advertises itself as a 'game metadata' utility and self-labels the probing as an 'Authorized PoC', but the executed behavior is unsolicited cloud-environment reconnaissance and cross-directory file writes on the installer's machine at install time, unrelated to any advertised utility functionality.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T04:18:14.127191903Z",
            "source": "amazon-inspector",
            "modified_time": "2026-08-19T04:18:04Z",
            "sha256": "5c88734e4d701b61fd197a942bc057f59c684d4eb9994ca0efc7136dfcf893c9",
            "id": "IN-MAL-2026-018357",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / nice-utils-helper

Package

Name
nice-utils-helper
View open source insights on deps.dev
Purl
pkg:npm/nice-utils-helper

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/nice-utils-helper/MAL-2026-14248.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "051e6a7d32321dba37a5f64d67e3b5e108f8eafea2d43e60d6d1dd5ad0c5e9dc",
            "path": "probe.js",
            "tlsh": "de4152ced1f6b0a553b2b3a8c22f03193563c1c74949de24fd9d43626f604782a218ed"
        }
    ],
    "package_integrity": [
        {
            "filename": "nice-utils-helper-1.0.0.tgz",
            "hashes": {
                "sha1": "86cd3cf28e8859d3db1ca321858743e44410ae6e",
                "sha512_sri": "sha512-6datUmOSNXNf/knPvcxNVzQUW1Fxbdsh4lgQGU4ZDSFnGZoQEBDoB7hV/4g2ktu5xPnfppbkCk5IrGYAqt7Gxw=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]