MAL-2026-4594

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/koishi-plugin-fusheng-car/MAL-2026-4594.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4594
Withdrawn
2026-05-26T22:13:04Z
Published
2026-05-25T13:45:25Z
Modified
2026-05-27T00:32:11.645840866Z
Summary
Malicious code in koishi-plugin-fusheng-car (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (35bbb2f7cdae32f1a5012363b81298fd339c96b83718db535d77c0bdc0f936ec)

lib/index.js contains a hardcoded base64-encoded QQ user ID ('Mjc1OTcyMDE2MQ==' decoding to '2759720161') checked inside the plugin's permission gate. When that ID matches the calling user, the function returns true and bypasses the operator's configured admin list and group-role checks, granting that account full control of the plugin's countdown task commands (start/stop/pause) on any bot that installs this plugin. The base64 wrapping has no functional purpose other than concealing the ID from casual review of the source. The plugin operator has not consented to a third party having admin-level authority over their bot, and the obfuscation indicates the author intended to hide the bypass.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "1.0.6"
            ],
            "import_time": "2026-05-26T05:53:01.040843492Z",
            "sha256": "35bbb2f7cdae32f1a5012363b81298fd339c96b83718db535d77c0bdc0f936ec",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-004648",
            "modified_time": "2026-05-25T13:45:25Z"
        }
    ]
}
References
Credits

Affected packages

npm / koishi-plugin-fusheng-car

Package

Name
koishi-plugin-fusheng-car
View open source insights on deps.dev
Purl
pkg:npm/koishi-plugin-fusheng-car

Affected ranges

Affected versions

1.*
1.0.6

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "6941df50e350710229c00661382dd6138074254b98d41b67856260e14da5bcb5",
            "tlsh": "8b32b90922fb543b412320745bbf15803a7a9b6bb216dd58ffdcd2a02f5d49286f5f88",
            "path": "lib/index.js"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "ecf76971401023da56d9fd365d918c9e0af2a127",
                "sha512_sri": "sha512-dFOeB7OiL7xP13ZsJHtrOdVcgdUJgmdRtZCdwx0S4cBypueBw76mJFJRxDeQjBTSrjcyzpwQhS5jupQxSbvDEg=="
            },
            "filename": "koishi-plugin-fusheng-car-1.0.6.tgz"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/koishi-plugin-fusheng-car/MAL-2026-4594.json"