MAL-2026-14478

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/mham-js/MAL-2026-14478.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14478
Published
2026-08-25T07:09:24Z
Modified
2026-08-25T23:49:44.633880072Z
Summary
Malicious code in mham-js (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f0dc3c71ee333b190e3e7202f7a222b4fe242fd50974cda9ec122b4200bd5f4f)

On import of mham-js, src/api/session-api.js runs top-level code that reads a file outside the package tree at../../../../public/logo.ico, decrypts its contents with CryptoJS.DES using the hardcoded password 'bf497c0b9cee', then spawns a detached node subprocess and pipes the decrypted bytes to its stdin for execution. The loader is disguised with cover-story names ('readLogoIco', 'rsa_exec', 'ThetaSDK initialization error'), and the README states the package does nothing on import, contradicting the actual behavior. The executed payload is stored encrypted outside the tarball, is not verified or documented, and consists of opaque attacker-controlled bytes handed directly to the Node interpreter as arbitrary code.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "1.0.4"
            ],
            "sha256": "f0dc3c71ee333b190e3e7202f7a222b4fe242fd50974cda9ec122b4200bd5f4f",
            "import_time": "2026-08-25T07:23:45.771686671Z",
            "modified_time": "2026-08-25T07:09:24Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018695"
        }
    ]
}
References
Credits

Affected packages

npm / mham-js

Package

Name
mham-js
View open source insights on deps.dev
Purl
pkg:npm/mham-js

Affected ranges

Affected versions

1.*
1.0.4

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "mham-js-1.0.4.tgz",
            "hashes": {
                "sha1": "e91e496d6229888114e1ba16934b4e07ff157de0",
                "sha512_sri": "sha512-EALjil3V+7TwFuqA4ARxoGZMmO6bITpWTmI2xS8ss6MQg5Po/i7LeuotauHTeNOYr4xJL8kzjPWaVL+3tjd2bA=="
            }
        }
    ],
    "evidence_files": [
        {
            "sha256": "506388a1987e85f27591742a70b35b4ce54a8c5d3db48fb53e16a6807f1cdb1b",
            "path": "src/api/session-api.js",
            "tlsh": "d4c1f15c2c03e12757f0e3bd4e32c454eb735a913b119aa1faac77a12f994d06532ed8"
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/mham-js/MAL-2026-14478.json"