MAL-2026-6368

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/decimal-format-utils/MAL-2026-6368.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6368
Published
2026-06-24T03:59:39Z
Modified
2026-06-24T05:01:22.572133151Z
Summary
Malicious code in decimal-format-utils (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (864677541e3090100ca588a37d8eb525f74817ade2fce5cb3e265af45b0c4e9a)

The postinstall script scripts/sync-peer.cjs runs npm pack decimal-format-utils@1.0.1 (or whatever version is configured via BACKUPTARGETVERSION/BACKUPPAYLOADSPEC), extracts the resulting tarball, overwrites every file of the installed v1.0.0 package in place via fs.cpSync over the package root, and then require()s the replaced index.js and awaits from_str(). The effect is that npm install decimal-format-utils@1.0.0 executes code from a different, publisher-mutable version at install time, bypassing lockfile pinning and giving the publisher a live remote code execution channel into every install. The package additionally impersonates the big.js maintainer: package.json sets author: Michael Mclaughlin and repository.url: https://github.com/MikeMcl/big.js.git, and the README falsely claims the package is pulled in automatically as a dependency of big.js@6.2.x. big.js declares no such dependency. The impersonation appears designed to lure installers into trusting an unrelated publisher whose postinstall then executes arbitrary fetched code.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-06-24T04:54:33.883195414Z",
            "source": "amazon-inspector",
            "sha256": "864677541e3090100ca588a37d8eb525f74817ade2fce5cb3e265af45b0c4e9a",
            "versions": [
                "1.0.0"
            ],
            "id": "IN-MAL-2026-007417",
            "modified_time": "2026-06-24T03:59:39Z"
        }
    ]
}
References
Credits

Affected packages

npm / decimal-format-utils

Package

Name
decimal-format-utils
View open source insights on deps.dev
Purl
pkg:npm/decimal-format-utils

Affected ranges

Affected versions

1.*
1.0.0

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "3f51f18916d317708bb297e55b2a102eb9ba84233241a7b1b6cca0c12fb55314316efd",
            "sha256": "213b589b069ddac2d3321b821e6337146a01d8743c67e4718bdf930b95e8c6e7",
            "path": "scripts/sync-peer.cjs"
        },
        {
            "tlsh": "56017b33de509c2759b89a6abdac4216b2520f1f11704c47b0fb511c8bb366714bab3d",
            "sha256": "12ea27fe474c67a40b17c5a5dd81136a2ba8651beb05ac9aaad570162f905366",
            "path": "package.json"
        }
    ],
    "package_integrity": [
        {
            "filename": "decimal-format-utils-1.0.0.tgz",
            "hashes": {
                "sha1": "1805b644c59273385ea94c304ced9d5bdf0ce1a2",
                "sha512_sri": "sha512-4Eah0MCKkP8gcCgeK3iGtwrccbvCwuUC9/ur0V2q85rgxhSZ6JdRQvhdgx2D5oyG0lJEKgY1aiwQ+xOhILVzJw=="
            }
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/decimal-format-utils/MAL-2026-6368.json"