MAL-2026-15632

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/node-request-utils/MAL-2026-15632.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15632
Published
2026-08-31T18:02:18Z
Modified
2026-08-31T18:31:23.140760225Z
Summary
Malicious code in node-request-utils (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0832f8d4554223aaaf958a5f008faa621b29c39f428c4fb042c084c05c4c7cef)

On npm install, package.json's postinstall runs index.js, which on Windows hosts downloads a JavaScript payload from https://limbomail.com/api/attachment/l4TIRPOsaUxR.603-vhKDRdgKl3RalNTVUZYGPsJy2Y/all.js (TLS verification disabled), writes it as winsvc.js under APPDATA, and executes it via wscript/node. The dropper installs multiple Windows persistence mechanisms — HKCU Run key, UserInitMprLogonScript, a scheduled task at \Microsoft\Windows\Shell\WinSvcHost, and a Startup folder.lnk pointing at a hidden VBS launcher — and re-checks the remote URL for updated payloads roughly every two hours. The install path uses -EncodedCommand PowerShell (UTF-16LE base64) with hidden-window flags and an AMSI bypass via amsiInitFailed reflection, and aborts on CI environments, low-CPU/low-memory hosts, and hostnames/usernames matching sandbox keywords (sandbox|virus|malware|sample|analysis|cuckoo|anyrun|hybrid) to evade analysis. index.js additionally sets Hidden/System file attributes on its dropped artifacts.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "0832f8d4554223aaaf958a5f008faa621b29c39f428c4fb042c084c05c4c7cef",
            "versions": [
                "1.0.0"
            ],
            "id": "IN-MAL-2026-019303",
            "modified_time": "2026-08-31T18:02:18Z",
            "source": "amazon-inspector",
            "import_time": "2026-08-31T18:22:29.429914667Z"
        }
    ]
}
References
Credits

Affected packages

npm / node-request-utils

Package

Name
node-request-utils
View open source insights on deps.dev
Purl
pkg:npm/node-request-utils

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/node-request-utils/MAL-2026-15632.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "a55bd4402f47b070c308b0d4bac1a90a51c0fba62e78d9ff3938efd33b89446b",
            "path": "index.js",
            "tlsh": "a4d10a79a2f14a33d2d266e461134b27a9f32213b50bc150f56cd989af45394c1e73fe"
        }
    ],
    "package_integrity": [
        {
            "filename": "node-request-utils-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-SbvF+pYkObbGuMQBoeffU/e3H2kjySXwPmNfxn5f8sL8JuWKyVkAJxZdzGxDzOvawN9+J5c6yxmc7lConlhMyA==",
                "sha1": "b613f0c3b357bff9245d5f9e9cec6564bf956813"
            }
        }
    ]
}