MAL-2026-6359

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/html-to-gutenberg/MAL-2026-6359.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-6359

Aliases

GHSA-2gqj-wrf5-35w8

Published

2026-06-24T01:51:00Z

Modified

2026-08-31T18:31:20.087669432Z

Summary

Malicious code in html-to-gutenberg (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d8a81a28406e20afb4ca23058394ebd8b749e84333b0fd24a3b2e63a65b18c57)

The tarball contains .vscode/tasks.json with a hidden task (hide: true, runOn: folderOpen, label eslint-check) whose command executes node./public/fonts/fa-solid-400.woff2. The referenced file is not a WOFF2 font; it is obfuscated Node.js source (hex-identifier obfuscator preamble global.i = 'A8'; const _0x3d50aa=_0x4540;..., global.r=require) that imports http, https, zlib, and child_process.spawn and references ETH_RPC_URL, INDEXER_URL, and multiple Ethereum RPC endpoints. The filename fa-solid-400.woff2 does not correspond to any real FontAwesome asset (the solid variant is weight 900) and it sits alongside genuine FontAwesome files in public/fonts/ to blend with static assets; the only reference to it is the hidden folderOpen task. Any developer who opens the project directory in VS Code triggers silent execution of the disguised payload on their workstation without any npm lifecycle script running.

Source: ghsa-malware (6381496c1a275836b5d3c11ca7f141ad32f84b5263450bf5cb3c9a91289dcd1d)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Database specific

{
    "malicious-packages-origins": [
        {
            "import_time": "2026-06-24T01:59:16.913511774Z",
            "source": "ghsa-malware",
            "versions": [
                "4.2.11"
            ],
            "id": "GHSA-2gqj-wrf5-35w8",
            "modified_time": "2026-06-24T01:51:05Z",
            "sha256": "6381496c1a275836b5d3c11ca7f141ad32f84b5263450bf5cb3c9a91289dcd1d"
        },
        {
            "import_time": "2026-08-02T22:41:04.665132Z",
            "source": "ghsa-malware",
            "versions": [
                "4.2.14",
                "4.2.11"
            ],
            "id": "GHSA-2gqj-wrf5-35w8",
            "modified_time": "2026-07-31T20:41:37Z",
            "sha256": "e311a5a838f758acacf488a502568566fb82c33303aee309a41614113ea6900c"
        },
        {
            "import_time": "2026-08-05T07:06:43.935046667Z",
            "id": "IN-MAL-2026-013371",
            "versions": [
                "4.2.14"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T06:13:36Z",
            "sha256": "3edf079490239b2b4c592ce4b7094c8089596437c15a73972ebd8282484a5273"
        },
        {
            "import_time": "2026-08-28T16:24:19.056893248Z",
            "source": "ghsa-malware",
            "versions": [
                "4.2.16",
                "4.2.15",
                "4.2.13",
                "4.2.12",
                "4.2.14",
                "4.2.11"
            ],
            "id": "GHSA-2gqj-wrf5-35w8",
            "modified_time": "2026-08-28T15:15:40Z",
            "sha256": "c6ca99ca29cc0ce98db0ac82ab220dbd8add677417dc2ac8e721f52eb2c14304"
        },
        {
            "import_time": "2026-08-31T18:22:30.131579173Z",
            "source": "amazon-inspector",
            "versions": [
                "4.2.17"
            ],
            "id": "IN-MAL-2026-019317",
            "modified_time": "2026-08-31T18:04:22Z",
            "sha256": "d8a81a28406e20afb4ca23058394ebd8b749e84333b0fd24a3b2e63a65b18c57"
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com

Affected packages

npm / html-to-gutenberg

Package

Name: html-to-gutenberg; View open source insights on deps.dev
Purl: pkg:npm/html-to-gutenberg

Affected ranges

Affected versions

4.*

4.2.11

4.2.12

4.2.13

4.2.14

4.2.15

4.2.16

4.2.17

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/html-to-gutenberg/MAL-2026-6359.json"

indicators

{
    "evidence_files": [
        {
            "path": ".vscode/tasks.json",
            "tlsh": "79017b35ed660e7700ca58a84c6da143993166131e8c3d2eb66d581c0f9d22f767778c",
            "sha256": "f5c6be4753d6613c97f1b10c4d93a5d97a8f4fb21eb13da0ed04b23a8a61c2f6"
        },
        {
            "path": "public/fonts/fa-solid-400.woff2",
            "tlsh": "a6f283843fc0b441274b2e3f7b1b74e8f21a1cb97988458bf614bc44f965616fae1a36",
            "sha256": "cd8445eb0f8810ba5ab9bf4f630f96d3a6be83eaa51aa25829686de49801947a"
        }
    ],
    "package_integrity": [
        {
            "filename": "html-to-gutenberg-4.2.14.tgz",
            "hashes": {
                "sha512_sri": "sha512-J9dmjnX2y24qNTUyyjUiD0cLAovFN0U512RT7VwTRW3dYcSEQwxeldDIP2/x+vengZtLNAUnJJxyohIOsMR7cw==",
                "sha1": "953a02d2a3d5de355519d9d4fec605bdf99dbc8e"
            }
        }
    ]
}

cwes

[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]