{"id":"MAL-2026-10405","summary":"Malicious code in @torbeck/heap (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b8f88862ffacb671bdaed8521274293d5ef20bafee0deb91cc38cd852daa6a7d)\n@torbeck/heap impersonates the legitimate @datastructures-js/heap package: README.md line 1 reads `# @datastructures-js/heap`, package.json sets homepage/repository/bugs to github.com/datastructures-js/heap and author to `Eyas Ranjous \u003ceyas-ranjous@gmail.com\u003e`, while the npm scope `@torbeck` is unrelated. The package re-exports the genuine Heap class so consumers get a working API. Appended to src/heap.js after `exports.Heap = Heap;` (around line 247) is a heavily obfuscated obfuscator.io payload (two rotated string-array RC4-style decoders, ~580 and ~700 entries, with Function.toString anti-tamper traps and console-method override checks). On `require('@torbeck/heap')` via the package's index.js main entry, the payload derives an AES key by XORing four hardcoded buffers, decrypts a hidden URL, issues an http/https.request to download a binary into os.tmpdir(), writes a PID lock and.meta.json with a sha256, chmods the file to 0755, and spawns it detached via process.execPath or `bash -c` with stdio:'ignore', windowsHide:true, and unref() — plus a re-exec wrapper that respawns the parent under a sentinel. Platform-specific branches handle win/linux/mac. There is no version pinning or signature check on the downloaded bytes, the URL is concealed by obfuscation, and the dropped binary's purpose is unrelated to a heap data-structure library. This is a typosquat carrying an install/require-time RCE dropper.\n","modified":"2026-07-13T07:47:00.903871083Z","published":"2026-07-13T06:53:07Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-07-13T06:53:14Z","sha256":"0999453caf66088321ca8bf3347a0e2c7cc7bc835589da8b6d2c904735d1f4d4","source":"amazon-inspector","versions":["4.3.14"],"import_time":"2026-07-13T07:40:12.305478052Z","id":"IN-MAL-2026-009839"},{"modified_time":"2026-07-13T06:53:07Z","sha256":"b8f88862ffacb671bdaed8521274293d5ef20bafee0deb91cc38cd852daa6a7d","source":"amazon-inspector","versions":["4.3.11"],"import_time":"2026-07-13T07:40:12.227981856Z","id":"IN-MAL-2026-009838"},{"modified_time":"2026-07-13T06:53:22Z","versions":["4.3.10"],"source":"amazon-inspector","sha256":"84b533170c48284483245bcf2eb3e05e1b7721ee4b40bac5328cd1466bd08b18","import_time":"2026-07-13T07:40:12.39331954Z","id":"IN-MAL-2026-009840"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@torbeck/heap/v/4.3.14"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@torbeck/heap/v/4.3.11"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@torbeck/heap/v/4.3.10"}],"affected":[{"package":{"name":"@torbeck/heap","ecosystem":"npm","purl":"pkg:npm/%40torbeck/heap"},"versions":["4.3.14","4.3.11","4.3.10"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@torbeck/heap/MAL-2026-10405.json","indicators":{"evidence_files":[{"sha256":"c0ccf76717c4fbb6bad0405fd18d64a662fd1d88a810e9d8e04e0bf4679821a0","tlsh":"81a31c857eeb30af525221b3512b6186e85d9c5db24c8508f465ccecff9423ce2a67bc","path":"src/heap.js"},{"sha256":"97e8bded23a9d0725301d5dd7bc2d442268b6fdfd821b605b413027d93a3e99e","tlsh":"61116aa8e97e8da30ad469d1a46e15517212588b4c48f84df396033c8f4e66f31f8b1e","path":"package.json"}],"package_integrity":[{"filename":"heap-4.3.14.tgz","hashes":{"sha512_sri":"sha512-6aw5nM2QQxymgkuqnKmsOItDqthH6G09dExKKLj3Uyhz+Gn1hF2zmI9yYDA+IpNHJRIVbSDM9oaoo8ApKmeZRQ==","sha1":"a0afa5e2b2e6b97ef702903ff4cf3b944db83a37"}}]}}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}