MAL-2026-7028

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/calvuepro/MAL-2026-7028.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-7028
Aliases
  • GHSA-82qq-fgw6-6hf8
Published
2026-07-09T05:53:35Z
Modified
2026-07-09T22:17:06.414519942Z
Summary
Malicious code in calvuepro (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (9de2057a076c31ca107db2c3e8d330a7b4aa2d8d67896cecd6c7ebef21d07731)

Package ships a 5.7MB prebuilt darwin-arm64 Mach-O at vendor/clavuepro-darwin-arm64 with no source tree, no hash/signature verification, and no upstream release URL to cross-reference. The bin wrapper bin/calvuepro.js chmods the binary 0755 and spawns it with the caller's argv via spawnSync. There are no lifecycle scripts and no main field, so the binary executes only when a user explicitly runs the CLI — not on npm install or require(). Notable inconsistency: the npm package name is calvuepro while the shipped binary, repository (mycode699/clavue-v2), and CLI alias all use clavuepro — a one-character difference that is worth a human review of publisher identity before trusting lifecycle execution of opaque native code. No exfiltration, no credential access, no install-time fetch+execute, and no network behavior was observed in the loader script.

Source: ghsa-malware (36e6f293ca556e3d3fdc61b38b76cbbbc74acabcd9dee4ccd35849747f183ff5)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "36e6f293ca556e3d3fdc61b38b76cbbbc74acabcd9dee4ccd35849747f183ff5",
            "id": "GHSA-82qq-fgw6-6hf8",
            "import_time": "2026-07-09T07:26:26.858319056Z",
            "modified_time": "2026-07-09T05:53:44Z",
            "ranges": [
                {
                    "type": "SEMVER",
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ]
                }
            ],
            "source": "ghsa-malware"
        },
        {
            "versions": [
                "0.1.0"
            ],
            "id": "IN-MAL-2026-009426",
            "modified_time": "2026-07-09T21:54:14Z",
            "sha256": "9de2057a076c31ca107db2c3e8d330a7b4aa2d8d67896cecd6c7ebef21d07731",
            "import_time": "2026-07-09T22:02:30.335847315Z",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / calvuepro

Package

Name
calvuepro
View open source insights on deps.dev
Purl
pkg:npm/calvuepro

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.1.0

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "ca7433526c115265a5bdc40e84eb95bf2b92f8519ce6926fbe7f43403fd89a26",
            "tlsh": "6921f3e4cbaa1e35b7b100c29b45742b6d4e5830a369d598e0bd814d37d2aecb1c63e9",
            "path": "bin/calvuepro.js"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/calvuepro/MAL-2026-7028.json"