MAL-2026-19144

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/strutil-helpers-core/MAL-2026-19144.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-19144
Published
2026-11-11T20:54:40Z
Modified
2026-11-11T21:15:14Z
Summary
Malicious code in strutil-helpers-core (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (db7da8999828536292e11d09747504d964bf7525862de7d207d03c8809c438a0)

The package advertises itself as lightweight string utility helpers (trim/capitalize/truncate), but ships a 17KB Linux ELF.node addon, a 434KB Windows PE.node addon, and a 3.7MB opaque.napi_cache data blob none of which are needed for the stated purpose. index.js unconditionally loads the platform-appropriate native addon on every require() and swallows errors silently before the trivial string helpers are even defined. The native addon references the adjacent.napi_cache blob and contains code paths for file I/O, fork/setsid/execlp on Linux and CreateProcessA with a 'node "%s"' command template on Windows, staging decoded JavaScript at /tmp/. (format string /tmp/.%u, %s.nc%lu.js) and executing it under node. Before firing, the addon enumerates CI and sandbox indicators (GITHUB_ACTIONS, GITLAB_CI, TRAVIS, CIRCLECI, JENKINS_URL, BUILDKITE, CODEBUILD_BUILD_ID, APPVEYOR, SEMAPHORE, TEAMCITY_VERSION, BITBUCKET_BUILD_NUMBER, NETLIFY, VERCEL, CF_BUILD_ID, SCREWDRIVER, SANDBOX), reads /proc/1/cgroup, /proc/1/cmdline, /proc/self/status (TracerPid) and /proc/self/maps for docker/containerd/kubepod/podman markers, and on Windows checks IsDebuggerPresent, CheckRemoteDebuggerPresent and scans running processes for analysis tools (wireshark, httpdebug, Process32First). The combination of a trivial cover-story API, undeclared native binaries loaded silently on import, an opaque sibling blob decrypted to a hidden /tmp staging path and executed under node, and sandbox/CI/debugger evasion gating is a load-time dropper that runs attacker-controlled code on the installer's host as soon as the package is required.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-022597",
            "import_time": "2026-11-11T21:05:22.750952947Z",
            "modified_time": "2026-11-11T20:54:40Z",
            "sha256": "09bade75e501a2d7f3c846895107147e88608a1712ed9df1ae477ac6efa3e5d4",
            "source": "amazon-inspector",
            "versions": [
                "1.0.1"
            ]
        },
        {
            "id": "IN-MAL-2026-022603",
            "import_time": "2026-11-11T21:05:23.204673146Z",
            "modified_time": "2026-11-11T20:55:22Z",
            "sha256": "db7da8999828536292e11d09747504d964bf7525862de7d207d03c8809c438a0",
            "source": "amazon-inspector",
            "versions": [
                "1.0.2"
            ]
        },
        {
            "id": "IN-MAL-2026-022599",
            "import_time": "2026-11-11T21:05:22.878609348Z",
            "modified_time": "2026-11-11T20:54:56Z",
            "sha256": "8ce3875e4b083194cad5109796dac0b1ed8dec78da0a302c33729c316fd23c18",
            "source": "amazon-inspector",
            "versions": [
                "1.0.4"
            ]
        },
        {
            "id": "IN-MAL-2026-022598",
            "import_time": "2026-11-11T21:05:22.818791833Z",
            "modified_time": "2026-11-11T20:54:48Z",
            "sha256": "a87c2de5924cb863efe7117762891a23e2e48b15915e3db6e77b96fe3192e381",
            "source": "amazon-inspector",
            "versions": [
                "1.0.5"
            ]
        },
        {
            "id": "IN-MAL-2026-022600",
            "import_time": "2026-11-11T21:05:22.947911305Z",
            "modified_time": "2026-11-11T20:55:04Z",
            "sha256": "afdf3cb6ed76afec475d41cd4b5cb34c42bf464c1bcfd52b21baba02290c5d2b",
            "source": "amazon-inspector",
            "versions": [
                "1.0.3"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / strutil-helpers-core

Package

Name
strutil-helpers-core
View open source insights on deps.dev
Purl
pkg:npm/strutil-helpers-core

Affected ranges

Affected versions

1.*
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "302c9c66aa41e64d15ee3e0d5979392fe677059b7d3c0cf4610cee9b27b15c43",
            "tlsh": "5ee020ccb692701d46f41a752b67528191d6c7d05849813194d644a8382449c2ee6c9f"
        },
        {
            "path": "native.napi.node",
            "sha256": "c7c76344ce570cf84aaa8c2ea7e5f1ec6f41fbfcbc8b11200ed41e96a22ba2b1",
            "tlsh": "6272954bd3a0dd3ec4d86231598b527252a2d070ef30172f0f54a6fb2d933586a7ae52"
        },
        {
            "path": "package.json",
            "sha256": "111eb2e89eb19abacef35a5080197b6f56a43d06245ffb00ab3d03e50352599d",
            "tlsh": "b4d02e3496016c2305dc8aa16a924a0401718e0b0244b81c3beb001d87bdaaf20fbaac"
        }
    ],
    "package_integrity": [
        {
            "filename": "strutil-helpers-core-1.0.1.tgz",
            "hashes": {
                "sha1": "e86980174cd5f7bee025da9ea59a8e7a2fb7ba02",
                "sha512_sri": "sha512-jVjUAYuydNbI6ffWVzcHvXRUeDvIwrWaC0kgxLlYGysBN2mIGxc262JfrEUeP9TnN/a+v/KjSNtWPaFeC/CuiA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/strutil-helpers-core/MAL-2026-19144.json"