MAL-2026-14280

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/mutex-core/MAL-2026-14280.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14280
Published
2026-08-19T07:52:21Z
Modified
2026-08-19T08:34:48.684106151Z
Summary
Malicious code in mutex-core (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8c015af803d9d4adc7d0578dc27795ebaef48e6ce25e9bf715b54af1e4991999)

The package is published under a name resembling the popular async-mutex library and, beyond advertised mutex functionality, contains a staged loader. lib/Mutex.js's Mutex.prototype.runExclusive checks whether a callback's meta.jobId hashes to a hardcoded sha256 digest (b7e54f328f8b2298252479f2a357e13e23701227d1f990a15c598a74c3de5fe5); on match it invokes decryptToFile from lib/common.js to AES-256-GCM-decrypt the sibling file lib/withMutex.min.js — a ~17KB base64 literal decoding to ~12.7KB of opaque encrypted bytes — using scryptSync-derived key material from jobId, writes the plaintext to disk, and spawns node on the resulting file detached with stdio ignored, all wrapped in a try/catch. lib/common.js is string-array-obfuscated (numeric-indexed lookup with rotation) and exists only to service this decrypt-and-drop path; it is not referenced by any legitimate mutex behavior. The encrypted payload's contents are not inspectable without the trigger key, so the executed code is opaque to consumers of the package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-19T07:52:21Z",
            "sha256": "8c015af803d9d4adc7d0578dc27795ebaef48e6ce25e9bf715b54af1e4991999",
            "versions": [
                "2.1.2"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018394",
            "import_time": "2026-08-19T08:15:31.859672251Z"
        }
    ]
}
References
Credits

Affected packages

npm / mutex-core

Package

Name
mutex-core
View open source insights on deps.dev
Purl
pkg:npm/mutex-core

Affected ranges

Affected versions

2.*
2.1.2

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/mutex-core/MAL-2026-14280.json"
indicators 
{
    "evidence_files": [
        {
            "path": "lib/Mutex.js",
            "sha256": "ad626b78f2f5ca13ad8b255a13b912bb1db69bfd564a91c99f7e39c97e4d0e13",
            "tlsh": "cf51e14457f3e516527370db873b9009b07c8037124cc9a5f94dc2ea6f5606887babec"
        },
        {
            "path": "lib/common.js",
            "sha256": "22c0e6da62021cce16f293679c859c2b6ab7920309f7a4109d03ea7b59d219d1",
            "tlsh": "2121f4993ecabcb4536a48da44ba68175c58fec06c0e73818157d1c53c79f60d0677bc"
        },
        {
            "path": "lib/withMutex.min.js",
            "sha256": "5d39fae4eab3c03b37af85906eee5c3a781992ab4c9bd7191734b337705cb484",
            "tlsh": "ad72d0150dbac7948e172328a68fbeaa32d4845f32c1c261462dcc1f513e0737dafa35"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "32447098953e7386ef1bdfaa646f60b55e016d34",
                "sha512_sri": "sha512-ulh4yYf2a3lOnwriM7XGiYnb8BK9qVpTRkymwkSiM8mmSZRuvko+Kuevm/bjhIvs+7HzOH31oUSDAqd74HQirg=="
            },
            "filename": "mutex-core-2.1.2.tgz"
        }
    ]
}