MAL-2026-19142

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/fcefi-wdojs-util/MAL-2026-19142.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-19142
Published
2026-11-11T21:01:46Z
Modified
2026-11-11T21:15:15Z
Summary
Malicious code in fcefi-wdojs-util (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (07a00a17209ccc173a7196dd8e97486609819945db1459a5333463be9f6c20b9)

fcefi-wdojs-util@1.0.0 ships a loader in index.js that reads an undeclared _bz numeric array (~1000 bytes) from its own package.json, zlib-inflates it, and executes the resulting JavaScript via the Function constructor on every require of the package. The loader is wrapped in an IIFE that explicitly short-circuits when any of CI, GITHUB_ACTIONS, GITLAB_CI, TRAVIS, CIRCLECI, or SANDBOX are set in the environment, so the payload only runs on developer and production hosts and stays inert in scanning environments. Adjacent to the loader, lib/native.pkg_config is a 2,890,302-byte file containing only hex characters with no printable strings and no relation to native code or pkg-config, consistent with an encrypted stage-2 payload decrypted by the inflated bytecode. The combination — executable code smuggled inside the manifest as a non-standard field, require-time Function()-based execution, deliberate CI/sandbox evasion, and a large opaque hex blob shipped as a misleadingly named config file — is a multi-stage dropper with no legitimate utility function.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-022606",
            "import_time": "2026-11-11T21:05:23.410349476Z",
            "modified_time": "2026-11-11T21:01:46Z",
            "sha256": "07a00a17209ccc173a7196dd8e97486609819945db1459a5333463be9f6c20b9",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / fcefi-wdojs-util

Package

Name
fcefi-wdojs-util
View open source insights on deps.dev
Purl
pkg:npm/fcefi-wdojs-util

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "95618430decba4e2a9241dbc787a7f5aa0a688797e2f648212c7d263f3738ba2",
            "tlsh": "88e0e54cb3b955185891db99a42dae0264f2bad60a958461a654b1832bb0b180b5241f"
        },
        {
            "path": "package.json",
            "sha256": "7419d2631c75a6d36abc4b690f9a86c824d020a3621d24d7420bd7c9357be6dc",
            "tlsh": "610210d61c0378d9b15cc97a107932454494bc23ac56fc8970aa4a834fef12e2bfee39"
        },
        {
            "path": "lib/native.pkg_config",
            "sha256": "1f6f1d1d1a2aab2daf8b4332b597522a445f70097128fa4b008822f1f218d157",
            "tlsh": "14d5bfbc76047de6266f576bda96acdc03b627639acba4cc8064b7c30563375fe02805"
        }
    ],
    "package_integrity": [
        {
            "filename": "fcefi-wdojs-util-1.0.0.tgz",
            "hashes": {
                "sha1": "03e9b0ae9968cecc960286830c198a6bc3775730",
                "sha512_sri": "sha512-prEBkDmY0C0p5ICO5nCLu39iT3jC4+YWLuA4reVqsYW3ft54dObX0+FEaL1DU5qa6ip5LigutT6RS5yJUCztVA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/fcefi-wdojs-util/MAL-2026-19142.json"