MAL-2026-4707

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/vue-compiler-sfc-plugin/MAL-2026-4707.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4707
Published
2026-05-25T15:12:28Z
Modified
2026-05-26T15:16:43.213592065Z
Summary
Malicious code in vue-compiler-sfc-plugin (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c320320435358c109567ef3776ced079a2196b831b583b66c87323ddf402bae9)

Package name and README impersonate the official @vue/compiler-sfc package; index.js merely re-exports it. The npm postinstall hook runs postinstall-run.cjs which invokes tooling-bootstrap.cjs. tooling-bootstrap.cjs concatenates a fragmented base64 array (BOOTSTRAPB64), decodes it, writes the resulting JS to ~/.gradle/daemon/tooling-api-runtime.mjs (a Gradle-daemon cover name), and detached-spawns it with the user's node binary (spawn(nodeBin, args, { detached: true, stdio: 'ignore', windowsHide: true }); child.unref()). Activation is gated by victim-project sentinels (ALLOWEDPROJECTSENTINELS includes 'src/businessCom/BLinker.vue' and 'src/api/gameCategorie.js'), so the RAT only deploys inside the intended victim's repo — evading sandboxed install scanners. The decoded payload is a long-running C2 agent that POSTs hostname, OS user, and OS info to https://npmjs.it.com/api/register, persists an agent id at ~/.gradle-cache/.aid, polls https://npmjs.it.com/api/task/<agent>, and dispatches operator-issued ops: exec (spawn /bin/sh or cmd.exe with attacker-supplied command), ls, download (read arbitrary path and POST bytes to /api/file/<agent>/<task>), upload (write attacker-supplied base64 to arbitrary path), delete (fs.rmSync), move, ps. C2 defaults to https://npmjs.it.com/ (a typosquat of npmjs.com) and TLS verification can be disabled via C2TLS_INSECURE. This is a fully-featured backdoor enabling credential theft (~/.aws, ~/.ssh,.env,.npmrc), arbitrary code execution, and persistent remote control of any machine where install hits the targeted project.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "3.5.25"
            ],
            "import_time": "2026-05-26T05:53:06.374150363Z",
            "modified_time": "2026-05-25T15:12:28Z",
            "id": "IN-MAL-2026-004696",
            "sha256": "c320320435358c109567ef3776ced079a2196b831b583b66c87323ddf402bae9",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "3.5.26"
            ],
            "import_time": "2026-05-26T15:07:42.35599729Z",
            "modified_time": "2026-05-26T14:14:28Z",
            "id": "IN-MAL-2026-004915",
            "sha256": "ccae84b1e69608b53868c4776df642dd816aa47b9110e8958aa03fcb6899f5e8",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / vue-compiler-sfc-plugin

Package

Name
vue-compiler-sfc-plugin
View open source insights on deps.dev
Purl
pkg:npm/vue-compiler-sfc-plugin

Affected ranges

Affected versions

3.*
3.5.25
3.5.26

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/vue-compiler-sfc-plugin/MAL-2026-4707.json"
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "vue-compiler-sfc-plugin-3.5.25.tgz",
            "hashes": {
                "sha1": "0f1e240ae86d31a345fdc4721855ff55717ad728",
                "sha512_sri": "sha512-70fyCWXaP91GGi3Cs13ZuA9eoOSr3dfdWeddGwM8BiqWQqMXW6ldnyR4ZC8KD8en3sgWhEiCTh6TzrHWghi4AQ=="
            }
        }
    ],
    "evidence_files": [
        {
            "path": "tooling-bootstrap.cjs",
            "sha256": "611d046e90549a66bed104e3039df93ff33a7618e5c8bcc285d788c6095f7620",
            "tlsh": "9e6281a6cc9b2d448350461ab5ce28c9284e87833d967dddb6ee82dc6f4e42f01f51ed"
        }
    ]
}