MAL-2026-19146

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/teahy-znrpz-util/MAL-2026-19146.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-19146
Published
2026-11-11T21:03:21Z
Modified
2026-11-11T21:15:16Z
Summary
Malicious code in teahy-znrpz-util (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5d18143cb6c6ab53a6b224630d1b50f00578f4308414da4f384281a679d7861d)

index.js reads a numeric byte array stored under a non-standard _bz key inside package.json, decompresses it with zlib.inflateSync, and executes the resulting string via the Function constructor with require and __dirname bound in — all on module load. Execution is gated by an early-return when any of CI, GITHUB_ACTIONS, GITLAB_CI, TRAVIS, CIRCLECI, or SANDBOX environment variables are set, so the hidden code only runs on real developer or production hosts. Smuggling executable logic as a zlib blob under a private manifest key, decoding it, and running it through Function() at require time is an obfuscated-loader pattern; the package's self-description as a 'utility' does not match any behavior visible in its source. The payload executes with full Node privileges on the installer's machine as soon as the module is required.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-022609",
            "import_time": "2026-11-11T21:05:23.639620173Z",
            "modified_time": "2026-11-11T21:03:21Z",
            "sha256": "5d18143cb6c6ab53a6b224630d1b50f00578f4308414da4f384281a679d7861d",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / teahy-znrpz-util

Package

Name
teahy-znrpz-util
View open source insights on deps.dev
Purl
pkg:npm/teahy-znrpz-util

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "95618430decba4e2a9241dbc787a7f5aa0a688797e2f648212c7d263f3738ba2",
            "tlsh": "88e0e54cb3b955185891db99a42dae0264f2bad60a958461a654b1832bb0b180b5241f"
        }
    ],
    "package_integrity": [
        {
            "filename": "teahy-znrpz-util-1.0.0.tgz",
            "hashes": {
                "sha1": "717d7d22cb4149ed7afc2052fa4b204bbf752229",
                "sha512_sri": "sha512-ICzlXwjQIPi2MfU/mb3sqGXX1WSfajsRlJFWlNv/5yxdJylwDT3S2NjSDRkM55i3FfAXcyU0ZhKiF7TtbRsLzw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/teahy-znrpz-util/MAL-2026-19146.json"