MAL-2026-5912

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/js-digest/MAL-2026-5912.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-5912
Published
2026-06-16T19:45:33Z
Modified
2026-06-16T20:01:51.433347206Z
Summary
Malicious code in js-digest (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (52847ff329757e0777e62c1c060455abc4ddd6f002c295a7f38d0e0489daf76f)

Package impersonates crypto-js: name is js-digest but package.json carries crypto-js's exact description ("JavaScript library of cryptography standards."), homepage http://github.com/brix/js-digest (brix is the crypto-js org), and author "Evan Vosberg" (the crypto-js maintainer). package.json declares "preinstall": "./lib/install-deps.mjs", but lib/install-deps.mjs is not JavaScript — it is a 3.2 MB Linux x86_64 ELF binary (magic 7F 45 4C 46, sha256 7883bda1ff15425f2dbe622c45a3ae105ddfa6175009bbf0b0cad9bf5c79b316). On npm install, npm's preinstall hook executes this native binary with the installer's privileges before any code is reviewed. Strings extracted from the binary show a multi-platform credential harvester: HTTP requests scraping GitHub (GET /user, /user/repos with Authorization: Bearer...), Slack (POST /api/auth.test with Cookie: d=), Discord, Microsoft Teams (/api/mt/*), and HashiCorp Vault (X-Vault-Token, /v1/...); reads of /.vault-token, /.vault/token, gpg --batch --no-tty --list-keys, and /proc/<pid>/{mem,cmdline,environ}; and multipart POST uploads to remote endpoints. The binary also embeds systemd unit templates ([Unit]/[Service]/ExecStart=.../Restart=always) for both system (/etc/systemd/system/) and user (~/.config/systemd/user/) scopes for persistence, plus libbpf rootkit primitives (bpf_object__open_mem, bpf_map__pin, bpf_program__attach, maps hidden_pids/hidden_inodes/hidden_names, /sys/fs/bpf/) for kernel-level concealment from ps/ls/lsof. Installing this package compromises the host with a persistent, hidden credential stealer.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-06-16T19:46:15.670149211Z",
            "source": "amazon-inspector",
            "sha256": "52847ff329757e0777e62c1c060455abc4ddd6f002c295a7f38d0e0489daf76f",
            "versions": [
                "4.2.2"
            ],
            "id": "IN-MAL-2026-006826",
            "modified_time": "2026-06-16T19:45:33Z"
        }
    ]
}
References
Credits

Affected packages

npm / js-digest

Package

Name
js-digest
View open source insights on deps.dev
Purl
pkg:npm/js-digest

Affected ranges

Affected versions

4.*
4.2.2

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "28e57f03f6e244e9d8a9cd70835fe237ea24b8855122b12b6bd45b413f26f309f5e791",
            "sha256": "7883bda1ff15425f2dbe622c45a3ae105ddfa6175009bbf0b0cad9bf5c79b316",
            "path": "lib/install-deps.mjs"
        },
        {
            "tlsh": "5c014570dc20dc761ad865929c7a88827a9008678c04bc0df3d7080c9f8d5af2abe34e",
            "sha256": "7627d4750cfc64e08b9f1057a1d68cd9fc6e35d07fcf3aa7e456a326413a30c1",
            "path": "package.json"
        }
    ],
    "package_integrity": [
        {
            "filename": "js-digest-4.2.2.tgz",
            "hashes": {
                "sha1": "25dc63fac83bcc50520f9584e99fcea38ce538a2",
                "sha512_sri": "sha512-7ggazjzzGjR/ZelAVvl9Bry0F0DMDHldZ97eF3IPlLBuS6ZTNO3tjm8UL/d5fXZX5TzMG/dZF2YCbrPrLgffXA=="
            }
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/js-digest/MAL-2026-5912.json"