MAL-2026-5892

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/caspian-day-js/MAL-2026-5892.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-5892
Published
2026-06-16T16:01:36Z
Modified
2026-06-16T16:16:49Z
Summary
Malicious code in caspian-day-js (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (895fe8e087ec7af36d61e8a6972f484e70bc1b828374ae83cef9ff4a927f7b55)

caspian-day-js impersonates the popular dayjs package: package.json copies author iamkun, homepage day.js.org, and repo github.com/iamkun/dayjs.git, and ships an unmodified dayjs.min.js as main so require('caspian-day-js') appears functional. The malicious payload is in the lifecycle hook: package.json declares postinstall: node setup.cjs. setup.cjs is heavily obfuscated (obfuscator.io-style string-array with a custom base64 decoder) and at install time sets NODE_TLS_REJECT_UNAUTHORIZED='0', fetches a remote JavaScript payload, writes it to <tmpdir>/<12-hex>.js, then spawns process.execPath on the dropped file (detached, stdio:'ignore', windowsHide:true) with the C2 endpoint 23.254.164.123:443 passed as argv[1], and finally unlinks setup.cjs to erase traces. Every machine running npm install caspian-day-js executes attacker-controlled JavaScript with TLS verification disabled, contacting 23.254.164.123:443.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-006769",
            "import_time": "2026-06-16T16:06:34.873779401Z",
            "modified_time": "2026-06-16T16:01:36Z",
            "sha256": "895fe8e087ec7af36d61e8a6972f484e70bc1b828374ae83cef9ff4a927f7b55",
            "source": "amazon-inspector",
            "versions": [
                "1.11.23"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / caspian-day-js

Package

Name
caspian-day-js
View open source insights on deps.dev
Purl
pkg:npm/caspian-day-js

Affected ranges

Affected versions

1.*
1.11.23

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "setup.cjs",
            "sha256": "944dc7fd9de2f2efcff6458501084324769f736053129c71db3bf8294478d5f5",
            "tlsh": "4991935a2795ac95438947f3ae1530c6f95bcdae3c5d8083f214e770be3263492c1a33"
        },
        {
            "path": "package.json",
            "sha256": "2a0438b85cb31f4090cc967b450ee89bde03fea62e409ebb39fbcfa82ed0514a",
            "tlsh": "a851e035cd298d632ac441b974ac828255b0c9a34c56fc1c73aa534c8f6d62f20bdf2d"
        }
    ],
    "package_integrity": [
        {
            "filename": "caspian-day-js-1.11.23.tgz",
            "hashes": {
                "sha1": "f85f58e998be886224b6b2cf7f5f0c552fe0e75d",
                "sha512_sri": "sha512-IPp7LDxRqjbY9uscGDk7oAGU5elYD+l3jsHL48Su90P+2U2Vm4pnslaLkt7dCX/xW9Dz61D7IOdD7FzwHvzjWg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/caspian-day-js/MAL-2026-5892.json"