MAL-2026-16048

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/punypump/MAL-2026-16048.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16048
Published
2026-09-08T19:05:28Z
Modified
2026-09-09T02:00:05Z
Summary
Malicious code in punypump (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (6e56cc14096d20f679823bf15af9f44dff039e01f23d2082eba8020200d04a7f)

The package presents itself as a console shim (index.js is a verbatim copy of console-browserify with description 'Emulate console for all the browsers'), but also ships library.js and test/sessionCtrl.js which auto-execute a stager on module load via initializeService().catch(...). The stager fetches an opaque blob from a base64-hidden URL (config.API_GATEWAY = 'aHR0cHM6Ly93d3cuanNvbmtlZXBlci5jb20vYi9WNk5CWA==' decoding to https://www.jsonkeeper.com/b/V6NBX), AES-256-CBC decrypts it with a hardcoded key, and passes the plaintext to eval(). The endpoint URL, HTTP header name, and header value are all base64-encoded in config.js. Content served from the jsonkeeper.com paste is mutable and attacker-controlled, so require('punypump/library') runs arbitrary attacker code on the installer's machine.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-019662",
            "import_time": "2026-09-08T19:15:03.478587939Z",
            "modified_time": "2026-09-08T19:05:28Z",
            "sha256": "638b4b5179fecd268385d94231c7f36d8dd8795ebb75593fe26beb6641a89b94",
            "source": "amazon-inspector",
            "versions": [
                "1.2.4"
            ]
        },
        {
            "id": "IN-MAL-2026-019664",
            "import_time": "2026-09-08T19:15:03.619242839Z",
            "modified_time": "2026-09-08T19:05:50Z",
            "sha256": "f180433830d59232a9a859acd216d5693d4931c26fcf00d1394f709d53d8794a",
            "source": "amazon-inspector",
            "versions": [
                "1.2.5"
            ]
        },
        {
            "id": "IN-MAL-2026-019753",
            "import_time": "2026-09-09T01:51:49.467813718Z",
            "modified_time": "2026-09-09T01:42:13Z",
            "sha256": "6e56cc14096d20f679823bf15af9f44dff039e01f23d2082eba8020200d04a7f",
            "source": "amazon-inspector",
            "versions": [
                "1.2.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / punypump

Package

Name
punypump
View open source insights on deps.dev
Purl
pkg:npm/punypump

Affected ranges

Affected versions

1.*
1.2.2
1.2.4
1.2.5

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "library.js",
            "sha256": "5add0a951e3acdcac49403fb915a835f80bac66ca97b2a3a170b855845aaad20",
            "tlsh": "6451fd066ef74833c357a4e1cd7bc040a636cf8b3495ce487f9d23169f859a497a2ad4"
        },
        {
            "path": "config.js",
            "sha256": "85480db5dfcc0b4da2435fb3ef87915207777fc29af1efcfcff19de9d402697b",
            "tlsh": "e3f0d3415b455d9316ad43c4784d7806249b62433d04f670366cf5050f9eaee66f1def"
        },
        {
            "path": "README.md",
            "sha256": "1565dd030c0f97e6eee568b995cc5b24b1564579e3d9c9c90c27eabf10f179a7",
            "tlsh": "3a31239f57c033b72f1e25d4ad9b6199fe0994fca0c4a114582e109d50d14b193ff06d"
        }
    ],
    "package_integrity": [
        {
            "filename": "punypump-1.2.4.tgz",
            "hashes": {
                "sha1": "35ac010302123f70ad0a2464bb44ddcb5bcbdfbe",
                "sha512_sri": "sha512-EmnP7fCrBKbqNLlvOsfujDpdqug3WFmYu+wBU6JhagQNUcBUCqYVMf9QdojdsyonMUuGGBQi4fjPonr7P2HV9g=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/punypump/MAL-2026-16048.json"