MAL-2026-4581

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/idlidosa/MAL-2026-4581.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4581
Published
2026-05-20T07:38:38Z
Modified
2026-06-12T20:01:52Z
Summary
Malicious code in idlidosa (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5c6cba2c58d95d705af7dc5bb1c630129127835fb1ef15d4ccf43ec2818bf632)

The package is purpose-built tooling to defeat exam-proctoring / lockdown software, with multiple installer-machine integrity harms triggered when the user runs the documented idlidosa start command:

  1. Binary masquerade as Microsoft software: dist/cli/index.js (~line 290) copies the bundled electron.exe to msedgewebview2.exe and uses bundled rcedit to overwrite its Windows version resources to claim CompanyName=Microsoft Corporation and ProductName=Microsoft Edge WebView2 Runtime. The guard process additionally sets process.title = "Windows Audio Device Graph Isolation". An administrator auditing the host sees what appears to be a Microsoft component but is an unsigned Electron app under this package's control.

  2. Persistence as fake Edge updater: installResurrector (~line 330) registers a Windows Scheduled Task named MicrosoftEdgeWebView2Update that runs every 1 minute via schtasks /create... /sc MINUTE /mo 1 /f, re-spawning a launcher written to %APPDATA%/Idlidosa/resurrect.js. The task name impersonates a legitimate Microsoft Edge update job.

  3. Anti-detection watchdog: cli/guard.cjs carries self-incriminating comments stating the 1500ms restart delay is fast enough to beat TestPad's 30s scan and that it runs as node.exe (which lockdown software rarely kills).

  4. Process-wide TLS validation disabled: dist/shared/index.js (~line 187) sets process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0" at module load, disabling TLS certificate validation for every HTTPS call made by the host Node process for the lifetime of that process — not just calls made by this package. Subsequent traffic (including screenshots of the user's screen and bundled API keys) is sent over un-validated TLS and is exposed to MITM on the installer's network.

  5. Bundled decryptable Groq API key pool: shared/keys.json ships nine AES-256-GCM-encrypted Groq API keys whose decryption key is sha256("pageai-pool-v2") (literal byte array in shared/crypto.ts), so any installer can decrypt them. These are the author's own keys (author self-harm), but they are used as the default channel for sending the user's screen captures over the TLS-disabled connection.

The combination of Microsoft-impersonation on disk, Microsoft-impersonation as a scheduled task, watchdog comments documenting evasion intent, and global TLS weakening constitutes deliberate harm to the integrity of any host this is installed and run on.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-003495",
            "import_time": "2026-05-26T05:50:44.033497656Z",
            "modified_time": "2026-05-20T07:38:38Z",
            "sha256": "93244f4468caec1832fe03d87c7403d7ab1dac835f12605a35667acfd3b87c39",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-005810",
            "import_time": "2026-06-12T19:43:35.770287506Z",
            "modified_time": "2026-06-12T19:02:25Z",
            "sha256": "1a75611f2e499729979c4f3e6a846e27ca06346f89dc51131d467a6511d4ffa6",
            "source": "amazon-inspector",
            "versions": [
                "1.0.1"
            ]
        },
        {
            "id": "IN-MAL-2026-005813",
            "import_time": "2026-06-12T19:43:36.056812262Z",
            "modified_time": "2026-06-12T19:02:30Z",
            "sha256": "359ad22216d5124d653c6e6d7c72c1d004966ae82d6a4675e30cfd638ce351e9",
            "source": "amazon-inspector",
            "versions": [
                "1.0.7"
            ]
        },
        {
            "id": "IN-MAL-2026-005812",
            "import_time": "2026-06-12T19:43:35.968583861Z",
            "modified_time": "2026-06-12T19:02:28Z",
            "sha256": "5c6cba2c58d95d705af7dc5bb1c630129127835fb1ef15d4ccf43ec2818bf632",
            "source": "amazon-inspector",
            "versions": [
                "1.0.4"
            ]
        },
        {
            "id": "IN-MAL-2026-005811",
            "import_time": "2026-06-12T19:43:35.881018295Z",
            "modified_time": "2026-06-12T19:02:26Z",
            "sha256": "f88aa47e4a8bb442e853910f1f832ffc260bb47680cc63a321e2c3d5f7e41b0e",
            "source": "amazon-inspector",
            "versions": [
                "1.0.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / idlidosa

Package

Name
idlidosa
View open source insights on deps.dev
Purl
pkg:npm/idlidosa

Affected ranges

Affected versions

1.*
1.0.0
1.0.1
1.0.2
1.0.4
1.0.7

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "shared/keys.json",
            "sha256": "a50bab4cd4aa3ca52f42b2b69c264c09ee15a465cd8b5cea38441b444fcfca1c",
            "tlsh": "11119640e8b1ec34d99ae208c3131665461754172da7bf0f7a08458e4bdf9eea7360d8"
        },
        {
            "path": "dist/cli/index.js",
            "sha256": "df6db9d5c5fbf2c6fee358e646ca96e5be619866b67861f2b55e907481e55c4f",
            "tlsh": "58a20a9d74f51a3a41f320f6a81b401771a08523360deec476acaba82fae578c5f75dc"
        },
        {
            "path": "desktop/resources/inject_dll.ps1",
            "sha256": "fe75cf773fb0304449d32891082e71eead1b911658b87a610577d7d8db7d6793",
            "tlsh": "0e4158452f56ab2134a3ad2d46cec46df20b90b213bf991879fc4330af1a09dd17a756"
        },
        {
            "path": "cli/guard.cjs",
            "sha256": "09cc2095c902d6505401f3a9d1dca25946604b3ebe5bad89a54e3efe5d7af982",
            "tlsh": "a871754972f60a6c12f3c1b6223ba41b17e7c619620cc995a41ee6873f9427f01e6dfd"
        }
    ],
    "package_integrity": [
        {
            "filename": "idlidosa-1.0.0.tgz",
            "hashes": {
                "sha1": "e332e3ad55557b5d8b7bbc4660fb7d93c8729c5f",
                "sha512_sri": "sha512-4hTjAeZiwBsrGBYXFr/aOWTX/BFyC7e/QJB3g7B3/ZiwPAsitVFhLUZevrdyrY/mhSapFPGq3lmJcKao2oSvwg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/idlidosa/MAL-2026-4581.json"