MAL-2026-17235

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/items-validator/MAL-2026-17235.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17235
Published
2026-09-28T22:03:57Z
Modified
2026-09-28T22:30:06Z
Summary
Malicious code in items-validator (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a8e49b1abd7c566b17104c5a2823251df2ca253a0fa509d7c19db1c1942ad13d)

On require, index.js invokes initializeDaemon() at top level, which uses spawn('node', [lib/check-items.js], { detached: true, stdio: 'ignore' }) followed by child.unref() to launch a persistent background process independent of the parent. The daemon HTTP-GETs a JSON payload from the hardcoded endpoint https://game.spawnrealm.com/api/item-realtime?key=abcdef123456 and passes payload.code to new Function('require', 'module', payload.code), executing server-supplied JavaScript inside the installer's Node process with full require access. An RSA signature check is performed against a public key bundled in the package (crypto-config.js), so the author controls both the signing key and the verifier and the check provides no independent integrity guarantee. Anyone controlling game.spawnrealm.com — including via DNS or TLS — can run arbitrary code as the installing user for the lifetime of the host process. The package is advertised as a validator library, and this remote-code-loader behavior is undisclosed and unrelated to the stated purpose.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020612",
            "import_time":  "2026-09-28T22:18:22.617475759Z",
            "modified_time":  "2026-09-28T22:03:57Z",
            "sha256":  "a8e49b1abd7c566b17104c5a2823251df2ca253a0fa509d7c19db1c1942ad13d",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.5"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / items-validator

Package

Name
items-validator
View open source insights on deps.dev
Purl
pkg:npm/items-validator

Affected ranges

Affected versions

1.*
1.0.5

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "lib/check-items.js",
            "sha256":  "ec1f4da780fb3263d71ea555f4bcbdfd8416e98611bd1ad29f3cc053cb8840ba",
            "tlsh":  "08a1768ead4b92371eb642f44317602afb5e91832790d255bbcdd34c2fb811c9325cea"
        },
        {
            "path":  "index.js",
            "sha256":  "32985404eebe9f1ff6887d25b383a152b58522fd8b102385269501d3aa8e29cf",
            "tlsh":  "1a11e1e636daa5667c72afe1e9378111be16c11277004011b8edbad70fe19864353cbd"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "items-validator-1.0.5.tgz",
            "hashes":  {
                "sha1":  "5ec9999b56678b98ee984478b8c30c95fb477506",
                "sha512_sri":  "sha512-OTCjY7h3uNpCdIi1nFWcLipqLzc9Cc0stz5EV1bcKuHrerrlVrvDfyQ4DdCUBaU2u0fs8oDBVxaT1Zr+WBF4Jw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/items-validator/MAL-2026-17235.json"