MAL-2026-15604

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@worrisome/reutil/MAL-2026-15604.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15604
Published
2026-08-26T14:55:09Z
Modified
2026-09-09T03:30:12Z
Summary
Malicious code in @worrisome/reutil (npm)
Details

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security (see reference). The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute at npm install time. index.html renders a fake Cloudflare Turnstile verification widget. An obfuscator.io-obfuscated inline script POSTs a hardcoded per-package "hostKey" to https://api.keyval.org/get, receives a base64-encoded IV:ciphertext pair, decrypts it client-side via the Web Crypto API (AES-CTR) using an embedded key to obtain a redirect URL, appends the visitor's original query-string parameters, and navigates the browser there via window.location.replace(). This "dead drop" design lets the operator change the phishing destination for every package sharing a hostKey without republishing to npm; OX Security observed keyval.org-served destinations including a typosquatted Microsoft login page and, at time of writing, a ChatGPT redirect. The package therefore does not attack the installing machine directly; it is used as a static file host on the npm CDN (e.g. unpkg/jsDelivr) so the index.html can be linked to and opened directly in a victim's browser as a phishing/ClickFix landing page. Published by npm user "cattishly" as part of a burst of near-identical single-purpose packages published between 2026-08-04 and 2026-08-24 that share this same fake-Turnstile-redirect page structure.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (71b22071243e3b15f2851cb0146d99897ffd9e99c13e06e0af9f1efe5594a1a1)

The package was found to contain malicious code or consuming dependency that contains malicious code

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-019832",
            "import_time":  "2026-09-09T03:21:58.467812352Z",
            "modified_time":  "2026-09-09T02:52:31Z",
            "sha256":  "71b22071243e3b15f2851cb0146d99897ffd9e99c13e06e0af9f1efe5594a1a1",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-019831",
            "import_time":  "2026-09-09T03:21:58.376040745Z",
            "modified_time":  "2026-09-09T02:52:22Z",
            "sha256":  "ceac3153e46735eda039e1ae748bf401b54ef8410bc1cba49766518d05f8ab7b",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-019834",
            "import_time":  "2026-09-09T03:21:58.723975764Z",
            "modified_time":  "2026-09-09T02:52:53Z",
            "sha256":  "22f2441a1e150cd6616e3d1d284a8da9c8b612950af40bce2ee1c1c719e06f07",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.3"
            ]
        },
        {
            "id":  "IN-MAL-2026-019833",
            "import_time":  "2026-09-09T03:21:58.558376624Z",
            "modified_time":  "2026-09-09T02:52:39Z",
            "sha256":  "4c40f89f1dea7ec516cac82fcaadf461d864572ba178873b15f4d5b48e9dc1ba",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @worrisome/reutil

Package

Name
@worrisome/reutil
View open source insights on deps.dev
Purl
pkg:npm/%40worrisome/reutil

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.0.0
1.0.1
1.0.2
1.0.3

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity":  [
        {
            "filename":  "reutil-1.0.1.tgz",
            "hashes":  {
                "sha1":  "9b7a7a014774bbe6a5d447105188d7255b7daf3b",
                "sha512_sri":  "sha512-8cBlgV3f+F3eLTQQrONXXAz1eieqyuZoyyphiSW9hmApFCh+h8OR8XaIKgIIPJr31jRCyasLn86+BHQgAfPusA=="
            }
        }
    ]
}
iocs 
{
    "domains":  [
        "api.keyval.org"
    ],
    "files":  [
        {
            "digests":  {
                "sha256":  "f30a70e86f5aaf756b804cfbd337be56c785398e8b2bd1829bbbd680edae3f85"
            },
            "note":  "Fake Cloudflare Turnstile page bundled as the package's main entry (from v1.0.3, the latest published version)",
            "paths":  [
                "index.html"
            ],
            "source":  "PACKAGE_ARCHIVE"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@worrisome/reutil/MAL-2026-15604.json"