MAL-2026-4652

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/python-utils/MAL-2026-4652.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4652
Published
2026-05-20T02:36:56Z
Modified
2026-05-26T06:02:52.478433495Z
Summary
Malicious code in python-utils (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5b94c01fae325c5f5e92abd5da03527c54e22bb48202b1dc8b3e2c64947753b2)

package.json declares "preinstall": "./dist/typecheck.js". The referenced file is not JavaScript — it is a 5,224,556-byte Linux x86 ELF executable (containing __libc_start_main, /lib64, and nux-x86- interpreter strings) with the literal endpoint 207.90.194.2:443 baked into it. The native binary is concealed behind forged TypeScript build metadata: a sibling dist/typecheck.d.ts declares a getParser(): Promise<Parser> API for tree-sitter Python, and dist/typecheck.js.map is a reused copy of parser.js.map (its "file" field is "parser.js"), making the dropper look like ordinary tsdown output to a casual reviewer. On npm install on any Linux x86 host, the ELF runs automatically as the installer's user, calling out to the hardcoded IP:port. The package's stated purpose (a Python utility / tree-sitter parser wrapper) has no legitimate need to ship or execute a native binary at install time, and no pure-JS code path actually consumes getParser.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-05-20T02:36:56Z",
            "versions": [
                "0.2.26"
            ],
            "sha256": "5b94c01fae325c5f5e92abd5da03527c54e22bb48202b1dc8b3e2c64947753b2",
            "id": "IN-MAL-2026-003426",
            "source": "amazon-inspector",
            "import_time": "2026-05-26T05:50:37.227323345Z"
        }
    ]
}
References
Credits

Affected packages

npm / python-utils

Package

Name
python-utils
View open source insights on deps.dev
Purl
pkg:npm/python-utils

Affected ranges

Affected versions

0.*
0.2.26

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "cafebcfe50f4d6ed218f4525f44b81654bf2df4ebb06918984b4257940d4fd5b",
            "tlsh": "573633fb10d3b2ea31a258191ab675a067017c362d8e6110be4fd697d37dcdae16230f",
            "path": "dist/typecheck.js"
        },
        {
            "sha256": "d4f0edd5346dc9df95dc008b95c1bcb0ca83aaa92ee3dbc9a46e83a376605ede",
            "tlsh": "2a5133036c76c930b1212fe96d9d45416718b00c22d8da24bcac91213ba7f5ff9fb4a5",
            "path": "dist/typecheck.js.map"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-hXunJn8yfGgunf/SAgsm1RlfHE++k7XbiuaA9WHMcncmesxs5mcPCDknjBvYQrUyS9lFRjSlCmncdjjTljhYug==",
                "sha1": "22e94f6a4997a649f904de4e54772bf6349748d2"
            },
            "filename": "python-utils-0.2.26.tgz"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/python-utils/MAL-2026-4652.json"