MAL-2026-4563

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/finkrouter/MAL-2026-4563.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4563
Published
2026-05-22T10:25:25Z
Modified
2026-06-12T20:01:51Z
Summary
Malicious code in finkrouter (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (75cee0798d304ff9f0532df845511df6560314b8808664c15b3c3aa18f1953b5)

The package's CLI (shipped as cli.obf.js, the javascript-obfuscator output with RC4 string-array encoding and control-flow flattening per package.json prepublishOnly) prompts the user for an Auth Token and then writes ~/.claude/settings.json, setting ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN to a hardcoded API_BASE_URL whose literal is RC4-encoded so installers cannot audit the destination. Once configured, every Claude Code request — including source code, prompts, secrets embedded in prompts, and the Anthropic auth token — is silently relayed through the author's proxy instead of Anthropic. A provisionSentinel() routine writes ~/.fink/sentinel.js and appends (cd ~ && node ~/.fink/sentinel.js &) # Fink Sentinel to ~/.bashrc, ~/.zshrc, ~/.profile (or registers equivalents via PowerShell setx on Windows), giving the daemon persistence across reboots independent of the npm package. installECC() performs git clone <RC4-encoded URL> into ~/.fink, then on subsequent invocations runs git fetch --all && git reset --hard origin/main followed by npm install in the cloned tree — a mutable-branch, unpinned remote-code channel allowing the author to ship arbitrary new code into the installer's home directory on every CLI run. A purgeCaveman() routine additionally tampers with a competing tool's configuration by deleting hooks, agents, and statusLine entries referencing 'caveman' from ~/.claude/settings.json and stripping ## Caveman sections from CLAUDE.md files in $HOME and CWD. Together these constitute credential capture, silent relay of sensitive AI traffic, persistent backdoor, and an unpinned remote-code execution channel.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-004187",
            "import_time": "2026-05-26T05:52:06.387990665Z",
            "modified_time": "2026-05-22T10:25:25Z",
            "sha256": "ff852ad2ff69ee287dd37d79ea134314ffca73772068117b819495250ff401f3",
            "source": "amazon-inspector",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "id": "IN-MAL-2026-006080",
            "import_time": "2026-06-12T19:44:05.809662313Z",
            "modified_time": "2026-06-12T19:08:21Z",
            "sha256": "75cee0798d304ff9f0532df845511df6560314b8808664c15b3c3aa18f1953b5",
            "source": "amazon-inspector",
            "versions": [
                "1.1.1"
            ]
        },
        {
            "id": "IN-MAL-2026-006081",
            "import_time": "2026-06-12T19:44:05.936368009Z",
            "modified_time": "2026-06-12T19:08:22Z",
            "sha256": "9ff19d6dc7e3eaa2ae39e6945fc76f54115dd7d885dae5b61b5b0b5c83ea4f6b",
            "source": "amazon-inspector",
            "versions": [
                "1.1.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / finkrouter

Package

Name
finkrouter
View open source insights on deps.dev
Purl
pkg:npm/finkrouter

Affected ranges

Affected versions

0.*
0.1.0
1.*
1.1.1
1.1.2

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "cli.obf.js",
            "sha256": "2ae04ffc731450dacb2f0c239635b7a2dc0639b6c5ba2a99e06080e296f0f866",
            "tlsh": "bc832ac4d281b4daa3871ef73a27a0e0f947448570888759e9c8bdbc7d64637e6f4a31"
        }
    ],
    "package_integrity": [
        {
            "filename": "finkrouter-0.1.0.tgz",
            "hashes": {
                "sha1": "65450f848fc344aafb13a49d86b15ef6ce2e828b",
                "sha512_sri": "sha512-Lt3JvcEjtTBh2uj54ngjZbGju1IafwOvO7Gqwu2tesgmJHfWvjScDiZIwoZys3SUt6wrW1KyTvieVFsGrJm7vA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/finkrouter/MAL-2026-4563.json"