MAL-2026-6140

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@httpactions/strict-uri-encode/MAL-2026-6140.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6140
Published
2026-06-18T18:39:24Z
Modified
2026-06-18T19:31:47.072318509Z
Summary
Malicious code in @httpactions/strict-uri-encode (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b90fd30f5d52b139ea7be77aa1782a5339f39355ec7ad532af2fa7a49616ff88)

@httpactions/strict-uri-encode impersonates the popular unscoped npm package 'strict-uri-encode' (~30M weekly downloads) by republishing the same name under a lookalike scope. The package ships no URI-encoding functionality; index.js is a heavily obfuscated dropper (obfuscator.io-style 110-entry rotating string array, base64-decoded module names for 'https', 'childprocess', 'writeFileSync', 'exec', 'spawn', 'hostname', 'username') that executes immediately on require() and again every ~10 minutes via setInterval. The dropper assembles a hardcoded IP-based URL from base64 fragments (e.g. 'MC44Ni4x' → '0.86.117.x'), HTTPS-GETs a remote payload, writes it to disk via fs.writeFileSync, and executes it via childprocess.exec/spawn — yielding arbitrary remote code execution on any machine that requires the module. In parallel, bt() POSTs {ts, type, hid, ss, cc} containing os.hostname() and os.userInfo().username to the same hardcoded IP, exfiltrating installer host identity unconditionally on import and on the 10-minute timer. Combination of typosquatted name, zero legitimate functionality, heavy obfuscation, hardcoded IP C2, host-identity exfiltration, and require-time fetch-and-execute is an unambiguous supply-chain attack.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "b90fd30f5d52b139ea7be77aa1782a5339f39355ec7ad532af2fa7a49616ff88",
            "source": "amazon-inspector",
            "modified_time": "2026-06-18T18:39:24Z",
            "versions": [
                "1.0.1"
            ],
            "id": "IN-MAL-2026-007015",
            "import_time": "2026-06-18T19:20:02.040734339Z"
        }
    ]
}
References
Credits

Affected packages

npm / @httpactions/strict-uri-encode

Package

Name
@httpactions/strict-uri-encode
View open source insights on deps.dev
Purl
pkg:npm/%40httpactions%2Fstrict-uri-encode

Affected ranges

Affected versions

1.*
1.0.1

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@httpactions/strict-uri-encode/MAL-2026-6140.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "94397cb3d725971892a20bbbcc2509009d4e15f96eab2e99bca04d6b0b05127b",
            "tlsh": "f31267897fe2f052d721647b6837625a632f4c8473084988f23615d0be1977af1b76ec",
            "path": "index.js"
        },
        {
            "sha256": "c0552adecca66ed6149b24cbed448fe5078c8df702c8d7dba4b23bd2278d5db3",
            "tlsh": "3bd0a7383961953305c606120c7aa45ab770df2f1044380987cb183c81df6b35cfa32d",
            "path": "package.json"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-w51inI48YEcRjhDF6776eIR8RbLSyyg9YVuOYnAA/OPoam+COg3PpZQesi/etByT/q5TGJdgUfBLlBWcX4zKBA==",
                "sha1": "cf0ffa0e74c1c1dd2bd4909c566eef0d2ff5e163"
            },
            "filename": "strict-uri-encode-1.0.1.tgz"
        }
    ]
}