MAL-2026-6380

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/system-core-utils/MAL-2026-6380.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6380
Published
2026-06-24T06:58:42Z
Modified
2026-06-24T08:01:24.055806111Z
Summary
Malicious code in system-core-utils (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0a1d575b5be4daa71ffea6c37e5990b0396f864234cb5f0488c11332cdd7e4d3)

On require/import, src/index.js shell-executes a hidden PowerShell one-liner that downloads launcher.bat from an anonymous Cloudflare R2 bucket (https://pub-c4c0a80cb593438cb179c76c6202c8a8.r2.dev/launcher.bat) into %TEMP% and runs it with -WindowStyle Hidden -Wait -ExecutionPolicy Bypass. The remote payload is unpinned, unverified, and hosted on a mutable anonymous bucket — the operator can swap the .bat content at any time. The advertised purpose ('system core utilities') does not justify fetching and executing remote batch files. Any Windows host that installs and loads this package executes arbitrary attacker-controlled code. The tarball additionally ships deze.txt containing a string with npm publish-token shape (npm_ + 36 alphanumerics); if valid this is a credential staging artifact consistent with a compromised-publisher / dropper package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-06-24T07:47:32.359581334Z",
            "source": "amazon-inspector",
            "sha256": "0a1d575b5be4daa71ffea6c37e5990b0396f864234cb5f0488c11332cdd7e4d3",
            "versions": [
                "1.0.0"
            ],
            "id": "IN-MAL-2026-007429",
            "modified_time": "2026-06-24T06:58:42Z"
        }
    ]
}
References
Credits

Affected packages

npm / system-core-utils

Package

Name
system-core-utils
View open source insights on deps.dev
Purl
pkg:npm/system-core-utils

Affected ranges

Affected versions

1.*
1.0.0

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "3fe0f11202fd0319c13b85d7489d953b534fa4092364c361777d9720af4c1a88d522ca",
            "sha256": "122c903287292bcaba788789b0db26a5e7eee0ddf6883041948892ceb5f96d72",
            "path": "src/index.js"
        },
        {
            "tlsh": "7b900454551140df133f70703c4301111307d4047dc0115347c10d343450440175034d",
            "sha256": "f0ba3ee6dd055b76355627a03cc6b46febfd6f052aa517f464262051c4047aff",
            "path": "deze.txt"
        }
    ],
    "package_integrity": [
        {
            "filename": "system-core-utils-1.0.0.tgz",
            "hashes": {
                "sha1": "205edf81efab99614201bb673a9368f8440ee241",
                "sha512_sri": "sha512-l3TrhHnTNTk3EB3gMiftqNlmUV2F2CuL2LoU6XP9tsimxu53EV1tXkz8M7uDb7t+fPv+T1mllMxrcfE4bfbNiQ=="
            }
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/system-core-utils/MAL-2026-6380.json"