MAL-2026-7010

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/crypto-promiser/MAL-2026-7010.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-7010
Published
2026-07-08T17:31:26Z
Modified
2026-07-08T21:46:51.343362205Z
Summary
Malicious code in crypto-promiser (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (25594e7865a7525aebefd2f1fcc8060f144bf202b1986875e1cfd95564f66e88)

crypto-promiser@1.0.1 is a typosquat of the legitimate crypto-promise package that ships a dropper in its lifecycle scripts. The declared postinstall runs prepinstall.js, which decodes a base64-hidden URL (aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iL1dEVDFI -> https://jsonkeeper.com/b/WDT1H) via atob, fetches JSON from that anonymous paste host with axios, and pipes the .cache field of the response into a detached node child process over stdin, executing attacker-controlled JavaScript on npm install. index.js also contains a top-level IIFE that dynamically imports./prepinstall.js, causing the same fetch-and-exec to fire when the package is require()d or imported. The package name is a single-character edit of crypto-promise and mirrors its API surface (hash, hmac, cipher, pbkdf2) as a lure. The remote payload host is anonymous and mutable, the destination is obfuscated behind base64, and executed bytes come from a non-registry third-party paste — arbitrary code execution on the installer machine at install time and at require time.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-07-08T17:31:26Z",
            "id": "IN-MAL-2026-008174",
            "source": "amazon-inspector",
            "import_time": "2026-07-08T17:40:20.115048959Z",
            "sha256": "25594e7865a7525aebefd2f1fcc8060f144bf202b1986875e1cfd95564f66e88",
            "versions": [
                "1.0.1"
            ]
        },
        {
            "modified_time": "2026-07-08T20:48:50Z",
            "id": "IN-MAL-2026-008610",
            "source": "amazon-inspector",
            "import_time": "2026-07-08T21:27:50.155796025Z",
            "sha256": "2a46357d63cf4bf7cac2adab122f202a921500a632c120d7191615172f3a2e78",
            "versions": [
                "1.0.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / crypto-promiser

Package

Name
crypto-promiser
View open source insights on deps.dev
Purl
pkg:npm/crypto-promiser

Affected ranges

Affected versions

1.*
1.0.1
1.0.2

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "crypto-promiser-1.0.1.tgz",
            "hashes": {
                "sha1": "954b3c225f59707243b4b82d327a5c13e598ca34",
                "sha512_sri": "sha512-oSa9+4MnSgkH2oejLOiQj4a2AayVMYW32Q8aHXNDYTw8/Umtm3gdSss6R5bQg4VGlkZtsbPbENjN3fEJGZf4ng=="
            }
        }
    ],
    "evidence_files": [
        {
            "path": "prepinstall.js",
            "tlsh": "41e02b5f313767791f700ed49832c6768d12a020f6c2d1e0a51a80576987746014bfe8",
            "sha256": "06b348bcac3ed4669e7f9f50522440b5598a044daf06fb8b46d2de310108fc5e"
        },
        {
            "path": "index.js",
            "tlsh": "6b01d8497efcf0d703d1a0d7453bfb81ed92b0a3b2008b65938bea5cc5e1168c93a594",
            "sha256": "72c465459ec2b1ccce5cee1a8357a218107a7da7198a3c396acdc3ac5abc51e5"
        },
        {
            "path": "package.json",
            "tlsh": "74019c96cc68d9772bc421f26c7a110bf620584b4918fc0a7387860c4bce8bb41bd26d",
            "sha256": "1c951f6f26ba91c72733e967984d8b2d7947df24b604357ae09f3e9a6a13fbc3"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/crypto-promiser/MAL-2026-7010.json"
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]