MAL-2026-4790

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/makecoder/MAL-2026-4790.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4790
Withdrawn
2026-05-26T18:46:32Z
Published
2026-05-26T09:10:24Z
Modified
2026-05-27T00:32:04.189339135Z
Summary
Malicious code in makecoder (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (bf72d8ec7b803169421eb83d7ccbbdcd0af3671592775e25df2f92b33dfde5a4)

scripts/postinstall.js runs automatically on npm install. When bun is not already present, it unconditionally executes curl -fsSL https://bun.sh/install | bash on Unix or powershell -Command "irm bun.sh/install.ps1 | iex" on Windows — fetching an unpinned, unhashed shell script over the network and piping it directly to a shell interpreter. The resulting Bun runtime is then used to launch a multi-megabyte bundled sibling (dist/<platform>/cc.js) via the package's _launchWithBun / _resolveBunPath paths. This is the alternate-runtime-dropper shape: any compromise or MITM of the install endpoint yields arbitrary code execution on the installer's machine, and the install script's footprint includes writing to ~/.bun and mutating shell RC files (~/.bashrc, ~/.zshrc) to extend PATH. Separately, the postinstall recursively copies the package's bundled claude/ directory into ~/.claude with force-overwrite, silently clobbering any existing Anthropic Claude Code CLI configuration the installer has set up. Network destinations referenced from the bundled code include geminicli.com, and several modules wrap child_process together with HTTP POST/fetch primitives, but the primary install-time risk is the unverified pipe-to-shell of a remote runtime installer.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-05-26T09:17:33.495846135Z",
            "source": "amazon-inspector",
            "modified_time": "2026-05-26T09:10:25Z",
            "sha256": "b5b4ff6dc5ba7cd7d01c3861db306cb66a304c0b08d82ce574c4823e54aed313",
            "id": "IN-MAL-2026-004882",
            "versions": [
                "4.0.54"
            ]
        },
        {
            "import_time": "2026-05-26T09:17:33.410968891Z",
            "source": "amazon-inspector",
            "modified_time": "2026-05-26T09:10:24Z",
            "sha256": "e0137a523475bcb007059cff32df9ab8c2d8facb91e0d4d6326189e51c6b7b2b",
            "id": "IN-MAL-2026-004881",
            "versions": [
                "4.0.54"
            ]
        },
        {
            "import_time": "2026-05-26T13:32:45.69800628Z",
            "source": "amazon-inspector",
            "modified_time": "2026-05-26T09:53:20Z",
            "sha256": "3bc499b7c33bc485d7f0546ff633fd057e3d0c18d0c56c3ed90093740f94f4a7",
            "id": "IN-MAL-2026-004891",
            "versions": [
                "4.0.57"
            ]
        },
        {
            "import_time": "2026-05-26T13:32:45.619946623Z",
            "source": "amazon-inspector",
            "modified_time": "2026-05-26T09:52:42Z",
            "sha256": "a6421705abbacb938518e92842923b02752567f48d038a1e5901abe2373da197",
            "id": "IN-MAL-2026-004890",
            "versions": [
                "4.0.56"
            ]
        },
        {
            "import_time": "2026-05-26T13:32:45.571811181Z",
            "source": "amazon-inspector",
            "modified_time": "2026-05-26T09:52:41Z",
            "sha256": "bf72d8ec7b803169421eb83d7ccbbdcd0af3671592775e25df2f92b33dfde5a4",
            "id": "IN-MAL-2026-004889",
            "versions": [
                "4.0.56"
            ]
        },
        {
            "import_time": "2026-05-26T13:32:45.74833145Z",
            "source": "amazon-inspector",
            "modified_time": "2026-05-26T09:53:20Z",
            "sha256": "c7252876263364809addb6164e78b4c190202a2a1b40554cd4b3a45d181e857a",
            "id": "IN-MAL-2026-004892",
            "versions": [
                "4.0.57"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / makecoder

Package

Name
makecoder
View open source insights on deps.dev
Purl
pkg:npm/makecoder

Affected ranges

Affected versions

4.*
4.0.54
4.0.56
4.0.57

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/makecoder/MAL-2026-4790.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "5db452cd7bac87b46b118485d8555ec7dbc3e3e9ef44bef0d1b71818ba9f351a",
            "path": "scripts/postinstall.js",
            "tlsh": "8a61f18a02f733326d6365ed2f8b045b229680532214ed1cbadd87c57f411348ae2bfd"
        }
    ],
    "domains": [
        "bun.sh"
    ],
    "package_integrity": [
        {
            "filename": "makecoder-4.0.54.tgz",
            "hashes": {
                "sha512_sri": "sha512-Qy4Fht90oI9D2wwr0/6IY9DJge/CECfnrjWmVwx0ippTVSh/n0Opga4S+AmQOG+oxvwmDcLF+O2xVtAppUCCQQ==",
                "sha1": "f69aef2d3ff857ebac7562369be8ae8343308839"
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]