MAL-2026-17330

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/imgbundle/MAL-2026-17330.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17330
Aliases
  • GHSA-hj6h-6xgx-mpjv
Published
2026-09-30T04:50:10Z
Modified
2026-10-07T23:30:04Z
Summary
Malicious code in imgbundle (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e14218599b46d143fa8e150156864d14d58c327bd8a8816221ac4e8c5cc99350)

The package advertises itself as an image bundler, but index.js performs no image bundling. On require, a top-level IIFE reads an AES-256-CBC-encrypted file at cdn-img-fetch/.cache/banner.jpg inside the sibling dependency cdn-img-fetch, decrypts it with a hardcoded key derived from sha256('nif-runtime-2027'), writes the plaintext to cdn-img-fetch/.runtime/rt.jpg, deletes the source file, and registers an fs.watch on the source directory so the decrypt-and-stage step still fires if the encrypted blob is delivered later. The package also calls cif.ensureCached() on the cdn-img-fetch dependency in an error-recovery path, wiring the two packages together as a coordinated staged dropper: cdn-img-fetch supplies the encrypted bytes and imgbundle acts as the decoder that materializes attacker-controlled content onto the installer's filesystem at import time. The README description of image bundling does not correspond to any code path in the module, and hardcoded-AES-key decryption of an opaque blob from another package is not a legitimate implementation of that stated purpose.

Source: ghsa-malware (6175161f6fa075711e55b1f0db7d346357ce5593b1e3b48fc30cd85aaad81576)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020810",
            "import_time":  "2026-09-30T05:19:45.839423747Z",
            "modified_time":  "2026-09-30T04:50:22Z",
            "sha256":  "1577a61d49bcd6bd941dc6901b176730252973766b198f2065baea643ca81a16",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-020809",
            "import_time":  "2026-09-30T05:19:45.75035256Z",
            "modified_time":  "2026-09-30T04:50:10Z",
            "sha256":  "e14218599b46d143fa8e150156864d14d58c327bd8a8816221ac4e8c5cc99350",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.1"
            ]
        },
        {
            "id":  "GHSA-hj6h-6xgx-mpjv",
            "import_time":  "2026-10-07T23:23:59.761879446Z",
            "modified_time":  "2026-10-07T23:06:15Z",
            "sha256":  "6175161f6fa075711e55b1f0db7d346357ce5593b1e3b48fc30cd85aaad81576",
            "source":  "ghsa-malware",
            "versions":  [
                "1.0.2",
                "1.0.1",
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / imgbundle

Package

Name
imgbundle
View open source insights on deps.dev
Purl
pkg:npm/imgbundle

Affected ranges

Affected versions

1.*
1.0.0
1.0.1
1.0.2

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "index.js",
            "sha256":  "081029d14ba1ddcdf8bee99e82bc3cc6b2fb1a19302532ca425e3c343934ed09",
            "tlsh":  "3f31234219f533354673a2eeaa6b5c8e21a3d6933316d948f6cc0dc60fb30348a325ad"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "imgbundle-1.0.0.tgz",
            "hashes":  {
                "sha1":  "5aa1a891215f673f4ac2761bf16b5c99ee9d13a0",
                "sha512_sri":  "sha512-v3XFGqCPkNOSyjEOD4Fz7AZpR93UmwTB73xpKIp8oPf3WGunhVPNqq/4GI3Sppe7hEd8fbc7wEr5ng8NHTlyww=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/imgbundle/MAL-2026-17330.json"