{"id":"MAL-2026-10738","summary":"Malicious code in mui-option (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8e1c3ec117eaeedbd4c3f64c2fec97d44e115d400c7e52082b7d6cc28f7c59ec)\nThe sole shipped file index.js is heavily obfuscated with a base64+RC4 string-array decoder that hides all module names, URLs, and method identifiers. On import (main entrypoint), it requires child_process, os, fs, path, crypto and https, issues an https.get to a runtime-decoded URL, splits the response on ':' into an IV and ciphertext, derives a key with crypto.scryptSync, decrypts the payload with crypto.createDecipheriv, writes the decrypted bytes to a file under os.tmpdir(), and executes that file via child_process.exec. The package has no legitimate advertised functionality, its name resembles the MUI ecosystem, and no other code path exists. Any project that requires mui-option triggers execution of attacker-controlled native code on the installer host. The tarball also ships npm_recovery_codes.txt containing five 64-character hex strings matching the format of npm 2FA recovery codes, suggesting a publishing-account compromise.\n","modified":"2026-07-16T19:19:48.580702971Z","published":"2026-07-16T18:36:24Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-07-16T18:36:24Z","sha256":"8e1c3ec117eaeedbd4c3f64c2fec97d44e115d400c7e52082b7d6cc28f7c59ec","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-010713","import_time":"2026-07-16T18:54:00.65371986Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/mui-option/v/1.0.0"}],"affected":[{"package":{"name":"mui-option","ecosystem":"npm","purl":"pkg:npm/mui-option"},"versions":["1.0.0"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"filename":"mui-option-1.0.0.tgz","hashes":{"sha512_sri":"sha512-B1TDWJLQx59YgsfC3dLm+luiywSZwZuBxmb5Q7crxMokqRxgvc4YVdVoL/BGYoE7plGGMzLJIozrYZ6WBkGbdw==","sha1":"eac439d266c9365e9dfb62a9c47627a2d3bf8227"}}],"evidence_files":[{"sha256":"e3e7b2e8b98ba8d52f781c1c1ebc8299bdc85da4fc2e5f50be38685a76d03775","tlsh":"92b297c83fc1b0d04627b0fba95b6594e13a6cccb38c9449f7a6f068fd58314e566b68","path":"index.js"},{"path":"npm_recovery_codes.txt","sha256":"b355830a244eff00049a313d6d47abaab1a5e2b418c04c9372a56ef268e4abbe","tlsh":"0ee0c06d98485b120d56daaad5582a031b6507218b7474252cdb85a10252d63db18814"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/mui-option/MAL-2026-10738.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}