MAL-2026-14281

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/mutex-lite/MAL-2026-14281.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14281
Published
2026-08-19T07:52:29Z
Modified
2026-08-19T08:34:48.677340096Z
Summary
Malicious code in mutex-lite (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d9dd128447234dcf0a624ed4128fc5135f11c4c0c4cd2b12b7b81614f50015c5)

The package is named to resemble async-mutex and exports a Mutex API with the same surface, but lib/Mutex.js has been altered so that Mutex.prototype.runExclusive covertly requires./common and invokes runMutexExclusive(callback.meta.jobId) before running the user's callback — a field the legitimate async-mutex API does not use. lib/common.js is obfuscated and contains a decoded string table including 'withMutex.min.js', 'aes-256-gcm', and 'scrypt' plus a hardcoded SHA1 gate 'b7e54f...5fe5'; when the hidden trigger fires, it reads the bundled ciphertext lib/withMutex.min.js, decrypts it with AES-256-GCM using material derived from callback.meta.jobId, writes the plaintext to os.tmpdir(), and runs it with require('child_process').spawn('node', [tempFile,...], {detached:true, stdio:'ignore', windowsHide:true}). The sibling file lib/withMutex.min.d.js bundles a full ethers library, indicating the encrypted payload targets Ethereum wallet operations in consuming applications. Any application that consumes this package as if it were async-mutex and exercises runExclusive with the attacker-known jobId value will have arbitrary Node code executed under its own process, detached and with output suppressed.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T08:15:31.898362751Z",
            "sha256": "d9dd128447234dcf0a624ed4128fc5135f11c4c0c4cd2b12b7b81614f50015c5",
            "modified_time": "2026-08-19T07:52:29Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018395",
            "versions": [
                "1.4.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / mutex-lite

Package

Name
mutex-lite
View open source insights on deps.dev
Purl
pkg:npm/mutex-lite

Affected ranges

Affected versions

1.*
1.4.2

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/mutex-lite/MAL-2026-14281.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "ab1d7cc1dbc66eca782f6c1d7725ea0bf4a0de10addae5ea0cd12fe26689e364",
            "path": "lib/common.js",
            "tlsh": "1e51c85d2f4c87344bc458ceba961487c5e9dc46e525e7c6834dcecb34a6b80026bbf4"
        },
        {
            "sha256": "a644efbd07053dca68adaf0cda57d70cf01f1250d4ae033f05b742ba7b2b8d82",
            "path": "lib/Mutex.js",
            "tlsh": "c9315e54a7f3e416537370eac73b9009f13c442b018cc865f84dd2ea6f6506847d9bad"
        },
        {
            "sha256": "fe353eb62aae6d33c0f8df6998beae23d4bdb975edb4679285f45e6c6db4c3ea",
            "tlsh": "e572d059a8bf1ba66bf84458f61d7f708ce2562137fa4603d9cb3e9269107223306c67",
            "path": "lib/withMutex.min.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "mutex-lite-1.4.2.tgz",
            "hashes": {
                "sha1": "a8ee3ddba1a5f0f5404f7bc8412bf5554c1426cf",
                "sha512_sri": "sha512-qPOhuPYrHX9SGzR8G9n2e2Ps1Qa4VGLYJ1a5k5vffQ1uzRSicNzwHspRYda82ZN8I2JtAGTMNXRu2pyW1jfDFg=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]