MAL-2026-6401

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/zenith-utils/MAL-2026-6401.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6401
Published
2026-06-24T18:05:07Z
Modified
2026-06-24T18:46:29.614980702Z
Summary
Malicious code in zenith-utils (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c29676376a28531b186e09fbf7e2d3a0697943ece764e0604ebbdd4b734ae094)

Package name is zenith-utils but the tarball is a verbatim copy of the nodemailer source tree (lib/nodemailer.js as main, lib/smtp-transport, lib/ses-transport, lib/dkim, lib/mail-composer, etc.; package.json author set to nodemailer's real maintainer 'Andris Reinman'). package.json declares postinstall: node lib/utils/index.js, which uses spawn with detached: true, stdio: ['ignore','ignore','ignore'], and child.unref() to launch lib/utils/smtp-connection/index.js as a hidden background process that survives the npm install command. That process forks lib/utils/smtp-connection/worker.js, which polls https://jsonkeeper.com/b/WDH3V in an infinite loop and executes the returned cookie field via new Function('require', r.data.cookie)(require). jsonkeeper.com is an anonymous, mutable paste host — the author can change the served payload at any time, granting arbitrary Node-privileged code execution on every machine that has installed the package. The detached/unref'd spawn is deliberately designed to hide the activity from npm's lifecycle logs while the eval loop runs persistently in the background.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-06-24T18:41:01.057182649Z",
            "source": "amazon-inspector",
            "sha256": "93912585a6536fdb12c8341a2a896f3c51943f70f74a0fdd45b0c4c76030ab2e",
            "versions": [
                "12.0.14"
            ],
            "id": "IN-MAL-2026-007442",
            "modified_time": "2026-06-24T18:05:12Z"
        },
        {
            "import_time": "2026-06-24T18:41:01.01892Z",
            "modified_time": "2026-06-24T18:05:07Z",
            "sha256": "c29676376a28531b186e09fbf7e2d3a0697943ece764e0604ebbdd4b734ae094",
            "versions": [
                "12.0.15"
            ],
            "id": "IN-MAL-2026-007441",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / zenith-utils

Package

Name
zenith-utils
View open source insights on deps.dev
Purl
pkg:npm/zenith-utils

Affected ranges

Affected versions

12.*
12.0.14
12.0.15

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "e9e0686327e4602e213615f2e79e20227007c1636a9afcd9b3c88bb256d2ed11d12ef4",
            "sha256": "f94135cbe8ec654951d9482c17411d4161390492c181be55c5add2e0f673a606",
            "path": "lib/utils/smtp-connection/index.js"
        },
        {
            "tlsh": "7cf0a6802cb8fb900345b0e7c0bbeb07a198a068312287a48a8f9d5a45868488a130dd",
            "sha256": "4aac106a4f36aba6433c7ded453d724307ee55616e240883cd46204549cf24b1",
            "path": "lib/utils/smtp-connection/parse.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "zenith-utils-12.0.14.tgz",
            "hashes": {
                "sha1": "dabb64ce9ff8824c76e3bf497652e379c8fe4a0d",
                "sha512_sri": "sha512-lF3G1vx+NnYo7cLWtRJUUL+S9gqDPd0knoOTk8/Al7ifnnME1H2QuCLR4dR18o6nxVZ8GuT4Wkqg8mGU1UWQLw=="
            }
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/zenith-utils/MAL-2026-6401.json"