MAL-2026-17474

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/core-js-gnz/MAL-2026-17474.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17474
Published
2026-10-04T23:15:14Z
Modified
2026-10-04T23:30:05Z
Summary
Malicious code in core-js-gnz (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (dc57686b95f827f2c3b0501d97b6575e077247255bf5d4227ae9bc8bedd43937)

On install, package.json runs node init.js as a postinstall hook. init.js collects host identifiers (os.hostname(), os.userInfo().username, os.platform(), os.arch(), node version, OS release) and POSTs them to https://helper.businesse-vip1.workers.dev/report, then fetches an AES-256-GCM encrypted blob from the /e endpoint on the same host (with TLS verification disabled via rejectUnauthorized:false), decrypts it in-process, writes the decoded content to the user cache directory as exec_runtime.py, and spawns a detached python3 process to execute it (stdio:'ignore', windowsHide, detached:true). Execution is gated on developer-machine heuristics (presence of Desktop/Documents/Downloads in the home directory) and rate-limited via a hidden ~/.cache/core-js-buffer/.init_check marker, with cover-story identifiers ('Environment check', 'TelemetrySender', a BIP-174 seed label). The package name and README advertise an unrelated hex-buffer utility, which does not match the observed behavior.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020892",
            "import_time":  "2026-10-04T23:16:30.779270217Z",
            "modified_time":  "2026-10-04T23:15:14Z",
            "sha256":  "dc57686b95f827f2c3b0501d97b6575e077247255bf5d4227ae9bc8bedd43937",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / core-js-gnz

Package

Name
core-js-gnz
View open source insights on deps.dev
Purl
pkg:npm/core-js-gnz

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "init.js",
            "sha256":  "5dceefe88e4597f230e83c98adc40db14a8ffc4cfdc5659c603edc2febc2d51e",
            "tlsh":  "26a12ef669f2b23032b2f25d826f900aa267f113314aea90f85c72501fdd02c47a5df8"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "core-js-gnz-1.0.0.tgz",
            "hashes":  {
                "sha1":  "935453fb72dd574e88dd17066a04555f789e8e24",
                "sha512_sri":  "sha512-5nE0tAU62fBZaX9+B9T2l31oiR2z2vm0vG+K/09gi4c4uz08jk1F9d91xxuuL7/uPelHHI7689z7oqOG3QWwUA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/core-js-gnz/MAL-2026-17474.json"