{"id":"MAL-2026-10535","summary":"Malicious code in my-empty-package (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (914ffc98ce1f6553e4f9655208318800d0d22663842eb4c9a3d0d51d4f143bdd)\npackage.json declares `postinstall: node index.js`. On `npm install`, index.js branches on `os.platform()` and executes platform-specific shell commands: `osascript` on macOS, `powershell -WindowStyle Hidden -EncodedCommand \u003cbase64-UTF16LE\u003e` on Windows, and `python3 -c 'os.system(...)'` on Linux. After the payload runs, a cleanup step renames a shipped `package.md` over `package.json` and unlinks `index.js` itself, removing the install-time script from disk and presenting a different manifest to any post-install inspection. The hidden-window base64-encoded PowerShell invocation is a standard malware evasion technique. Manifest swap + entrypoint self-deletion is anti-forensic behavior with no legitimate purpose. Even though the current payload body is a benign demonstration (opens the calculator), the delivery framework is a fully-functional install-time RCE dropper skeleton: any content placed in the platform branches would execute automatically on install with the user's privileges and then erase its own traces.\n","modified":"2026-07-14T04:46:57.604524504Z","published":"2026-07-14T03:57:12Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-07-14T03:57:12Z","sha256":"914ffc98ce1f6553e4f9655208318800d0d22663842eb4c9a3d0d51d4f143bdd","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-010388","import_time":"2026-07-14T04:32:00.331549657Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/my-empty-package/v/1.0.0"}],"affected":[{"package":{"name":"my-empty-package","ecosystem":"npm","purl":"pkg:npm/my-empty-package"},"versions":["1.0.0"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"sha256":"ba863a083c54fd75f7341c1020db15b6d26622c72922716b3e1feadfd0c1496f","tlsh":"f2219c6446faab3189a2abd6199b041d3157a4523642fac939cc57846f9143402b2ab8","path":"index.js"}],"package_integrity":[{"filename":"my-empty-package-1.0.0.tgz","hashes":{"sha1":"11c9b8fa4788771bf9d22695a5ac6796aa940ddd","sha512_sri":"sha512-7nSci3HjMWN0dT5SJvcsLBGZEmtkBbBsp29ylrUM/Syi0/uqAzP4q5/YFp0ODl2OuE9qboPByjOOpxsANwGs6w=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/my-empty-package/MAL-2026-10535.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}