MAL-2026-14477

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/js-soul/MAL-2026-14477.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14477
Published
2026-08-25T07:08:58Z
Modified
2026-08-25T23:49:44.274799130Z
Summary
Malicious code in js-soul (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3e5bb2e2d2011a8e8bcc3c0fba8aeed7cca1e1b92e19ea867535a27dbf2cc500)

On module load, src/api/session-api.js reads../../../../public/logo.ico (a path outside the package), DES-decrypts the contents with the hardcoded key 'bf497c0b9cee', spawns a detached node child process via child_process.spawn with {detached:true}, and pipes the decrypted plaintext into the interpreter's stdin, executing arbitrary code at import 'js-soul'. The disguise of executable JavaScript as an image asset, the hardcoded DES key, and an unrelated 'ThetaSDK initialization error' catch-block string contradict the package's stated purpose as a session helper library and its README claim that nothing runs on import. Any code the attacker stages at the sibling path executes in the installer process with the installer's privileges.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "1.0.4"
            ],
            "source": "amazon-inspector",
            "sha256": "3e5bb2e2d2011a8e8bcc3c0fba8aeed7cca1e1b92e19ea867535a27dbf2cc500",
            "modified_time": "2026-08-25T07:08:58Z",
            "id": "IN-MAL-2026-018694",
            "import_time": "2026-08-25T07:23:45.307696656Z"
        }
    ]
}
References
Credits

Affected packages

npm / js-soul

Package

Name
js-soul
View open source insights on deps.dev
Purl
pkg:npm/js-soul

Affected ranges

Affected versions

1.*
1.0.4

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "d4c1f15c2c03e12757f0e3bd4e32c454eb735a913b119aa1faac77a12f994d06532ed8",
            "sha256": "506388a1987e85f27591742a70b35b4ce54a8c5d3db48fb53e16a6807f1cdb1b",
            "path": "src/api/session-api.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "js-soul-1.0.4.tgz",
            "hashes": {
                "sha512_sri": "sha512-0X5Sm6XN2H5ZFsg46If5C8dp5dBkmDQtlRbWBpsFxV+wnBBltTNM4SG6uUofIHgAqYM+5uVavOJ2jP0CKezz0w==",
                "sha1": "fe317845ae644a49db94f0880b3940e88ff89ed2"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/js-soul/MAL-2026-14477.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]