MAL-2026-16172

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@biz44/runtime-utils/MAL-2026-16172.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-16172

Published

2026-09-14T03:39:58Z

Modified

2026-09-15T06:30:04Z

Summary

Malicious code in @biz44/runtime-utils (npm)

Details

This package is part of a malicious npm campaign published by the biz44 account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and implements clipboard collection, keyboard and mouse event collection, filesystem scanning, and theft of Chrome extension storage.

Database specific

{
    "iocs": {
        "ips": [
            "103.170.217.184"
        ],
        "urls": [
            "https://api.npoint.io/641d37178a880b1e8b8f",
            "https://api.npoint.io/33e8d008c334b060adad",
            "https://api.npoint.io/933a731a5e97f4b45249",
            "https://api.npoint.io/24c25d5f5fcbb0992a4f",
            "https://api.npoint.io/ddae72efbb6714fae922",
            "https://api.npoint.io/37c0a0c68bf7a94ed731",
            "http://103.170.217.184:8787"
        ]
    }
}

Credits

- ESTsecurity - FINDER

Affected packages

npm / @biz44/runtime-utils

Package

Name: @biz44/runtime-utils; View open source insights on deps.dev
Purl: pkg:npm/%40biz44/runtime-utils

Affected ranges

Affected versions

1.*

1.1.11

1.1.13

1.1.81

1.1.96

1.1.100

Database specific

cwes

[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@biz44/runtime-utils/MAL-2026-16172.json"