{"id":"MAL-2026-10438","summary":"Malicious code in netspeedutil (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e07c032df7e95243bcbf1af8d20d23ef9427620fc3050965ca1a3b3ce9faa4f1)\nOn install, setup.js walks up to the installer's project tree and scans image files for a '__STEG__' marker. When found, it AES-256-CBC-decrypts an embedded steganographic payload that points to a file inside the installer's node_modules and uses a regex (`cli.command(\"build [root]\"...finally{...}`) to patch that third-party CLI's build command, prepending an import of netspeedutil/inject.js and an `await inject()` call inside the build's finally block. Once tampered, every subsequent project build runs inject.js, which uses javascript-obfuscator (control-flow flattening, dead-code injection, base64 string-array encoding) to embed an obfuscated client into dist/index.html. That client opens a WebRTC TURN connection to a hardcoded attacker host at 13.234.111.178:3478 as a covert C2 / signaling channel and renders attacker-supplied DOM content to end users of any site the developer ships. The package's stated purpose ('Fast string matching and pattern validation utilities') is a cover story unrelated to the actual code. This is a build-pipeline supply-chain compromise: the installer's production artifacts are silently weaponized against their own end users.\n","modified":"2026-07-13T10:47:05.998835027Z","published":"2026-07-13T09:22:42Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-07-13T09:22:42Z","sha256":"e07c032df7e95243bcbf1af8d20d23ef9427620fc3050965ca1a3b3ce9faa4f1","source":"amazon-inspector","versions":["1.0.13"],"id":"IN-MAL-2026-010209","import_time":"2026-07-13T10:37:37.939109253Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/netspeedutil/v/1.0.13"}],"affected":[{"package":{"name":"netspeedutil","ecosystem":"npm","purl":"pkg:npm/netspeedutil"},"versions":["1.0.13"],"database_specific":{"indicators":{"package_integrity":[{"filename":"netspeedutil-1.0.13.tgz","hashes":{"sha1":"d98c7d0d3c8da0118074c9d95cb6e8e946f2c53b","sha512_sri":"sha512-CJs9D8nxvXMTYdEjwFJzOwXynDYXIwmwu4MJPVJqnSUy/xftPZ300fVhaKCb2FiCvzWqRh4Q3I8QzyONZsWAkQ=="}}],"evidence_files":[{"sha256":"7efde05d8f284658812cf01c6081f0e4495839048f1f8f6ce4048cdb1deced49","tlsh":"bb6174c466fa232643a2327bf15b440ab369f4023609d694fa1cdb147f47174e9e36d9","path":"setup.js"},{"sha256":"01a8d0caa80766a19edd7f016a2dd6c2d89a7d6815a3f7566681ebe2ec3419a0","tlsh":"d0d1c685bcf32190426360bad27fd10a6232e5433509d9587f8cda519f9871cadb77dc","path":"inject.js"},{"sha256":"42857935f9c782d95b778fa65b7bb0e29849a57bc92a163469bec277c09fbedb","tlsh":"9dd0c2208c21ea6326c926950479c4436ab24c1b0204ac6c97c310a8868e3ff59be30e","path":"package.json"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/netspeedutil/MAL-2026-10438.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}