MAL-2026-6723

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/electron-orbit/MAL-2026-6723.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6723
Published
2026-07-01T21:15:10Z
Modified
2026-07-01T22:16:51.538375235Z
Summary
Malicious code in electron-orbit (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (7faf51a6c9d6ed9fce8cf9de9ea8afee0e9c3dc1fb254e8cd0c3c2a8ca61323f)

On require('electron-orbit'), the module unconditionally fires an auto-prefetch pipeline in Node contexts (when no document is present) that opens a raw node:net socket to electronorbit.blob.core.windows.net:443 and speaks a hand-written TLS 1.3 stack (custom ClientHello, HKDF key schedule, AES-128-GCM in aetherls.ts) rather than using https, bypassing standard TLS interception and static inspection. Every network-related string — the Azure hostname components, node:net, connect, ALPN http/1.1, HTTP request line, marker filename, and process.env enumeration keys — is XOR-obfuscated through a helper __s(key, arr). The postinstall script install.js writes an install marker to os.tmpdir()/electron_orbit_install_marker.txt containing process.env entries whose keys match path (PATH-family variables) plus process.cwd(), and separately stages os.hostname(), os.userInfo().username, process.version, platform and arch into a decoy file under bin/formatters/ prefixed with a fake native-binary magic byte. On require, index.ts reads the tmpdir marker, XORs it with the string electron-orbit, hex-encodes it, and appends the result as a query-string suffix to the Azure blob URL, so the storage account's HTTP request logs capture the installer's PATH-family environment and working directory. Activation is gated: the destination host is only populated when the SHA-256 of process.env.BuildType is a substring of a hardcoded 64-hex constant (0ceaa396…8295); otherwise the source is set to %TEMP% and the request fails to resolve, keeping the payload dormant on non-targeted installers and firing only when a specific env var is set (e.g., in a chosen CI environment). The advertised purpose (Electron-style runtime discovery) has no relationship to icon fetching or SVG rendering; the icon surface is a pretext — getRegisteredIcon returns a hardcoded empty <svg> regardless of the network response.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "1.0.21"
            ],
            "sha256": "10848278600fe8696063359d8f022d4d0732ac5825506d800707afe08110320e",
            "modified_time": "2026-07-01T21:17:12Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-007924",
            "import_time": "2026-07-01T22:03:00.008165656Z"
        },
        {
            "versions": [
                "1.0.11"
            ],
            "sha256": "b925cd8754d91ca746f88287af2d6331578be16f842665ba2dd746665d20089a",
            "modified_time": "2026-07-01T21:18:29Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-007932",
            "import_time": "2026-07-01T22:03:00.537333616Z"
        },
        {
            "versions": [
                "1.0.14"
            ],
            "sha256": "47e8d77c0b581ef00c04e40584b9242f1e948d0330e76f877783a975d863d244",
            "modified_time": "2026-07-01T21:18:22Z",
            "source": "amazon-inspector",
            "import_time": "2026-07-01T22:03:00.466853262Z",
            "id": "IN-MAL-2026-007931"
        },
        {
            "versions": [
                "1.0.4"
            ],
            "sha256": "92153bc4e68cffd4c1d0e5b11ca3bc772f77b25cfbe012b5f71614de1288b990",
            "modified_time": "2026-07-01T21:19:02Z",
            "source": "amazon-inspector",
            "import_time": "2026-07-01T22:03:00.819999477Z",
            "id": "IN-MAL-2026-007936"
        },
        {
            "versions": [
                "1.0.22"
            ],
            "sha256": "952200b7df4332004cc5fefbaa4bcb7d8f1ab097c295e79afae66fe19d23aae6",
            "source": "amazon-inspector",
            "modified_time": "2026-07-01T21:16:54Z",
            "id": "IN-MAL-2026-007922",
            "import_time": "2026-07-01T22:02:59.898992079Z"
        },
        {
            "versions": [
                "1.0.23"
            ],
            "sha256": "e88ccedca508e4a1138bf6749aeb112e97fdea672ffd4d8553d99da05dbc84a5",
            "source": "amazon-inspector",
            "modified_time": "2026-07-01T21:17:04Z",
            "id": "IN-MAL-2026-007923",
            "import_time": "2026-07-01T22:02:59.969074194Z"
        },
        {
            "versions": [
                "1.0.13"
            ],
            "sha256": "8de289d6073561060a409931399a18484fd826ada63e5fae4f2b30c618172ac4",
            "modified_time": "2026-07-01T21:18:03Z",
            "source": "amazon-inspector",
            "import_time": "2026-07-01T22:03:00.311405766Z",
            "id": "IN-MAL-2026-007929"
        },
        {
            "versions": [
                "1.0.20"
            ],
            "sha256": "c29ff208e55231dcf792181b153ecbf8d546a0f285f415ccae0358f0d0e757d1",
            "modified_time": "2026-07-01T21:17:32Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-007926",
            "import_time": "2026-07-01T22:03:00.17503458Z"
        },
        {
            "versions": [
                "1.0.26"
            ],
            "sha256": "816096531ac2b919acfef3d9512968cf694c98e14cb2ee1ce1430877ce39170a",
            "modified_time": "2026-07-01T21:16:14Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-007918",
            "import_time": "2026-07-01T22:02:59.695838704Z"
        },
        {
            "versions": [
                "1.0.10"
            ],
            "sha256": "19c68f98c57515e576aef9cc6bd4d2801f813b382d3ea55091c423663d8106cf",
            "modified_time": "2026-07-01T21:18:38Z",
            "source": "amazon-inspector",
            "import_time": "2026-07-01T22:03:00.584279878Z",
            "id": "IN-MAL-2026-007933"
        },
        {
            "versions": [
                "1.0.15"
            ],
            "sha256": "36ceb992564dfb37d1d5d28dc2b31f99361fc1392c85592bfce2b97eef195c90",
            "source": "amazon-inspector",
            "modified_time": "2026-07-01T21:17:53Z",
            "id": "IN-MAL-2026-007928",
            "import_time": "2026-07-01T22:03:00.253967834Z"
        },
        {
            "versions": [
                "1.0.12"
            ],
            "sha256": "54c50d1b1671037faea6193cf6d7994bfd7c4fba7640d2935546712d7ebed8e7",
            "modified_time": "2026-07-01T21:18:12Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-007930",
            "import_time": "2026-07-01T22:03:00.427547597Z"
        },
        {
            "versions": [
                "1.0.3"
            ],
            "sha256": "77275717c30e5629daba99b0a9ae1dd5a30b7b3fb013fe66a66a8213ab32ad8e",
            "modified_time": "2026-07-01T21:19:27Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-007939",
            "import_time": "2026-07-01T22:03:00.97514881Z"
        },
        {
            "versions": [
                "1.0.33"
            ],
            "sha256": "78d034e73e1a01e3c47c1b0ade337cd56fd392e0be1398b13fbdf051d6166220",
            "modified_time": "2026-07-01T21:15:45Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-007914",
            "import_time": "2026-07-01T22:02:59.522446423Z"
        },
        {
            "versions": [
                "1.0.34"
            ],
            "sha256": "bae81fe7c1395441c366ea9e03e33844d0f8ce1cd5d05c40873cd4fb858bb64d",
            "modified_time": "2026-07-01T21:15:19Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-007911",
            "import_time": "2026-07-01T22:02:59.407241934Z"
        },
        {
            "versions": [
                "1.0.36"
            ],
            "sha256": "6245487ae50f09a690451f235b8c9855d2f666f2b0a25e93871cf7a1251b5d69",
            "modified_time": "2026-07-01T21:15:26Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-007912",
            "import_time": "2026-07-01T22:02:59.444375253Z"
        },
        {
            "versions": [
                "1.0.28"
            ],
            "sha256": "7faf51a6c9d6ed9fce8cf9de9ea8afee0e9c3dc1fb254e8cd0c3c2a8ca61323f",
            "modified_time": "2026-07-01T21:16:21Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-007919",
            "import_time": "2026-07-01T22:02:59.770673779Z"
        },
        {
            "versions": [
                "1.0.27"
            ],
            "sha256": "74a4c2467a3c20b1532b6935cc3ae3c984c06c696a4a430c886f155a562ce3f4",
            "source": "amazon-inspector",
            "modified_time": "2026-07-01T21:16:07Z",
            "id": "IN-MAL-2026-007917",
            "import_time": "2026-07-01T22:02:59.656385696Z"
        },
        {
            "versions": [
                "1.0.29"
            ],
            "sha256": "8607b322e5ebd914296b192b0877ba45f5e9750dc69c924f7d939d2b8b378c5f",
            "modified_time": "2026-07-01T21:15:59Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-007916",
            "import_time": "2026-07-01T22:02:59.615635898Z"
        },
        {
            "versions": [
                "1.0.30"
            ],
            "sha256": "8c298b3f9b2691ab1ebb958398e1736aa636d9ee4e5d54acb0b57a5e1f93167c",
            "modified_time": "2026-07-01T21:15:52Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-007915",
            "import_time": "2026-07-01T22:02:59.555589088Z"
        },
        {
            "versions": [
                "1.0.25"
            ],
            "sha256": "9c9d089e560d6af7ee6fbfc04edfc6f073ef8fec7f555102011e47f2f33a3df7",
            "modified_time": "2026-07-01T21:16:33Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-007920",
            "import_time": "2026-07-01T22:02:59.802868311Z"
        },
        {
            "versions": [
                "1.0.7"
            ],
            "sha256": "d9634442d2460040970659611fb37887044b6a6f10a63c17f73161b1b21a3ce0",
            "modified_time": "2026-07-01T21:19:09Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-007937",
            "import_time": "2026-07-01T22:03:00.877084463Z"
        },
        {
            "versions": [
                "1.0.16"
            ],
            "sha256": "150616fc5c43dab7fcc26b65b7817ccc01229778cc7bcf143025d16b4d3cc3da",
            "source": "amazon-inspector",
            "modified_time": "2026-07-01T21:17:42Z",
            "id": "IN-MAL-2026-007927",
            "import_time": "2026-07-01T22:03:00.214957014Z"
        },
        {
            "versions": [
                "1.0.5"
            ],
            "sha256": "1d12525ca427cbe9367a0caefb4b1020cc0593fa2b428b691c0e635a48d2757c",
            "modified_time": "2026-07-01T21:19:17Z",
            "source": "amazon-inspector",
            "import_time": "2026-07-01T22:03:00.915016621Z",
            "id": "IN-MAL-2026-007938"
        },
        {
            "versions": [
                "1.0.9"
            ],
            "sha256": "70733642ade646f823a77e8ae1616337f76e9340fc84a3a5da7c2365a58f6d00",
            "modified_time": "2026-07-01T21:18:48Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-007934",
            "import_time": "2026-07-01T22:03:00.682327954Z"
        },
        {
            "versions": [
                "1.0.8"
            ],
            "sha256": "c37583c0ed58e2b399630b0a314361d54f7b4927faeadcba99122205c37d78fa",
            "modified_time": "2026-07-01T21:18:54Z",
            "source": "amazon-inspector",
            "import_time": "2026-07-01T22:03:00.733638694Z",
            "id": "IN-MAL-2026-007935"
        },
        {
            "versions": [
                "1.0.6"
            ],
            "sha256": "1402a4a73f05f68a55951e93a03c1758d6406fb97a056d84802c21244e3d5393",
            "modified_time": "2026-07-01T21:19:44Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-007941",
            "import_time": "2026-07-01T22:03:01.087889736Z"
        },
        {
            "versions": [
                "1.0.24"
            ],
            "sha256": "b81cc5f0d2ed6deaed9b0956f47d024f9c42b291090c71d5abec8e34d0c2ab62",
            "modified_time": "2026-07-01T21:16:46Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-007921",
            "import_time": "2026-07-01T22:02:59.843512238Z"
        },
        {
            "versions": [
                "1.0.32"
            ],
            "sha256": "c3b84ec0bc193e98c0c57657693f84fc2ccbe0ef8ed7a66b919d9ec486d5e515",
            "source": "amazon-inspector",
            "modified_time": "2026-07-01T21:15:36Z",
            "id": "IN-MAL-2026-007913",
            "import_time": "2026-07-01T22:02:59.476587914Z"
        },
        {
            "versions": [
                "1.0.18"
            ],
            "sha256": "b84bfc662b2e38c56da1343ec68aa18255a7a43be7a97ef9227de541e0a9a5a2",
            "modified_time": "2026-07-01T21:17:25Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-007925",
            "import_time": "2026-07-01T22:03:00.042382523Z"
        },
        {
            "versions": [
                "1.0.31"
            ],
            "sha256": "c7750cd6d1bd46851da24a4090675984c9f66dd4b8d3634e9a58ce6896a2c11c",
            "source": "amazon-inspector",
            "modified_time": "2026-07-01T21:15:10Z",
            "id": "IN-MAL-2026-007910",
            "import_time": "2026-07-01T22:02:59.371792985Z"
        }
    ]
}
References
Credits

Affected packages

npm / electron-orbit

Package

Name
electron-orbit
View open source insights on deps.dev
Purl
pkg:npm/electron-orbit

Affected ranges

Affected versions

1.*
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.0.10
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.18
1.0.20
1.0.21
1.0.22
1.0.23
1.0.24
1.0.25
1.0.26
1.0.27
1.0.28
1.0.29
1.0.30
1.0.31
1.0.32
1.0.33
1.0.34
1.0.36

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "electron-orbit-1.0.36.tgz",
            "hashes": {
                "sha512_sri": "sha512-WXA8oVnmBi3HZ5YQ+XHZDGBKK+CGruS364F6OhdRptVx6YHRYxFBvJc/9BwOniDn+PibLVMFlslORnO3EdKPZQ==",
                "sha1": "aca7b7cf1a21403da0981661ff9301a98ecf3f7d"
            }
        }
    ],
    "evidence_files": [
        {
            "sha256": "74371bc877a042a9e43f531ec89a9ceb11fb1e002fa19f7c5190799ec713a09c",
            "path": "install.js",
            "tlsh": "3ef1324286aa4670573213aa8d578d09f7369a170702525e7efd83885fb6c2094e3ffe"
        },
        {
            "sha256": "5442d0af9d1b2fda5b5f6ddecc9450d4b1aeeca0e015e1186ad3440b7ff72124",
            "path": "dist/index.js",
            "tlsh": "1d32a9907f50f0b5e3ad269594bba94bb3f459d0d80e0408e16998cf3a70cd4c677fa9"
        },
        {
            "sha256": "c4298a843c8b4ba6cc0bda50808a8e083754b57c92e3c8244573d6f96c5d4690",
            "path": "package.json",
            "tlsh": "84215637e4a4dd535af89b94a8790f89f2310b9f41145c0b74b2012c0bb646b01aebaf"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/electron-orbit/MAL-2026-6723.json"
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]