MAL-2026-5644

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/self-certificate/MAL-2026-5644.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-5644
Published
2026-06-11T13:02:34Z
Modified
2026-06-26T19:01:39.028844263Z
Summary
Malicious code in self-certificate (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ab587fcd5a0b45e17454fc742007b8b597a0aec49b443d8a5a087ba910ea4a40)

The package presents itself as a self-signed certificate generator, but its public generateCertificates() API path loads sample/cert.pem, strips the BEGIN/END CERTIFICATE armor, base64-decodes the body, and eval()s the result. The fake PEM is not a DER certificate — it decodes to a JavaScript IIFE that fetches https://aptupdate.org/settings/privacy.php (destination itself base64-encoded for a second layer of concealment) and pipes the response into a spawned python3/python interpreter (spawn('python3'|'python', ['-'], {stdio:['pipe','ignore','ignore'], detached:true, windowsHide:true})), writes the fetched bytes to stdin, and unref()s the child so it outlives the caller. The combination of cover-story file extension, double-base64-wrapped C2 URL, detached/hidden/stdio-ignored Python execution, and eval of a payload disguised as a certificate is a deliberately concealed remote-code execution backdoor against any consumer of the advertised API.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-005730",
            "modified_time": "2026-06-11T13:02:34Z",
            "import_time": "2026-06-11T13:27:20.534148804Z",
            "source": "amazon-inspector",
            "sha256": "4a2141f4facbd3abc437287c86971f1b3bb6795fad75990624f735b72139167d",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-007653",
            "source": "amazon-inspector",
            "import_time": "2026-06-26T18:42:50.035074564Z",
            "modified_time": "2026-06-26T18:18:17Z",
            "sha256": "ab587fcd5a0b45e17454fc742007b8b597a0aec49b443d8a5a087ba910ea4a40",
            "versions": [
                "1.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / self-certificate

Package

Name
self-certificate
View open source insights on deps.dev
Purl
pkg:npm/self-certificate

Affected ranges

Affected versions

1.*
1.0.0
1.1.0

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "self-certificate-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-/fVL29/HyMgsxmH6nplNP7M52rpNhRXLmmMlSS2ulwV9yD7nz2trODTNCxzOBDLuzM18UxiiNmSEIGRGusTtfQ==",
                "sha1": "2034d348c5e4ead18b83a05ddad6282dee19e097"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "index.js",
            "tlsh": "f541038579e2b96204d79674454b8050b42ce103b70aecab36de86d16f16e6cd27efcc",
            "sha256": "8df2981a688b04f04d130cf10c3715dec00d59b81953636d891aa2a3318e3982"
        },
        {
            "path": "sample/cert.pem",
            "tlsh": "4011d0029d972d990764f9ae14fd93c355af13c3b9e242f9489ed1a8297c09a18d8038",
            "sha256": "67642cb874a1de4a653491c56f4c3324fc95364da43724d07399b8a453908a18"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/self-certificate/MAL-2026-5644.json"