MAL-2026-14287

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@wizloft/harness-kernel/MAL-2026-14287.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14287
Published
2026-08-19T08:33:41Z
Modified
2026-08-19T09:00:19.342923659Z
Summary
Malicious code in @wizloft/harness-kernel (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b6d73d94752604c9b48dd785c20cee875e268bb52c673bf3817f95000830fa85)

dist/index.js contains an obfuscated top-level async IIFE that executes on import. It queries Ethereum JSON-RPC endpoints (eth.drpc.org, eth.publicnode.com, ethereum-rpc.publicnode.com, and an Etherscan-like API) for the most recent transaction from a hardcoded marker address (0xa322E5f39aDC2490Ef6f0121063e358050D311D3080e), parses the transaction's to field into two IPv4 addresses, HTTP-fetches XOR-encrypted payloads from http://<ip>/0x/ls and http://<ip>:443/0x/cl, XOR-decrypts them, then executes the resulting JavaScript via eval(...) and a detached spawn('node', ['-e', <decrypted>], {detached:true}). The entire loader is packed with obfuscator.io-style transforms (hex _0x identifiers, rotating string array _0x240a, control-flow flattening) that conceal the network-fetch-and-exec chain behind benign-looking exports. On-chain C2 makes the exfil/RCE destination mutable and takedown-resistant; the payload contents are opaque and attacker-controlled.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T08:48:53.812751851Z",
            "sha256": "b6d73d94752604c9b48dd785c20cee875e268bb52c673bf3817f95000830fa85",
            "modified_time": "2026-08-19T08:33:41Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018411",
            "versions": [
                "0.1.1-alpha.3"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @wizloft/harness-kernel

Package

Name
@wizloft/harness-kernel
View open source insights on deps.dev
Purl
pkg:npm/%40wizloft/harness-kernel

Affected ranges

Affected versions

0.*
0.1.1-alpha.3

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@wizloft/harness-kernel/MAL-2026-14287.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "9f1d1c07e25d5b396b7f55df0528ab30e468a01977c8dc9cd57d2cd1f43c7154",
            "path": "dist/index.js",
            "tlsh": "51e24184a7d0a440034b6abbbb1bf4e5e96a0cac75844ac7f11dbe84f766327e4f1531"
        }
    ],
    "package_integrity": [
        {
            "filename": "harness-kernel-0.1.1-alpha.3.tgz",
            "hashes": {
                "sha1": "8f362eda1bf516c074d3d599cba6b4f98f18d080",
                "sha512_sri": "sha512-O1jwC3sOspfwThpme5f/ivN6gNLZk5DubIRxSLToUYbKqt2YF6y+gZCo2kH/KOnZqIRb6FOUOUCYGmsF0/f32Q=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]