{"id":"MAL-2026-10743","summary":"Malicious code in nordpass (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9df6f21fababcd99ba522d380a0729d35aa4ff44ee2f6612fe75b906da844aee)\nPackage name impersonates the NordPass password-manager product while presenting itself as 'A simple authentication module.' The package.json postinstall runs `make -C src && cp src/auth_module./bin/flare && node src/install.js`. src/install.js is a ~100 KB heavily obfuscated file (obfuscator.io-style string-array decoder with rotation, unicode-escaped identifiers, XOR-numeric literals) that reads /etc/passwd, derives XOR key material from that content combined with hardcoded byte constants, base64-decodes an embedded payload, XOR-decrypts it, and passes the resulting string to eval(). The decode-and-exec path is guarded by anti-analysis checks: a NODE_OPTIONS `--inspect` check, a Date.now() timing gate, and an `OG_`-prefixed environment-variable kill switch. A compiled `auth_module` binary is also staged to `./bin/flare` during postinstall. The combination — brand impersonation, obfuscation, host-file read used as key material, base64+XOR+eval of an embedded blob, anti-debug and kill-switch guards, and a staged native binary — executes attacker-controlled code on the installer's machine at `npm install` time.\n\n## Source: ossf-package-analysis (9924ec9036b6c4caf7436a5e7ba79ed4e1b31fb1732c884d164c340a6982886d)\nThe OpenSSF Package Analysis project identified 'nordpass' @ 1.0.2 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","modified":"2026-08-05T06:36:22.249577985Z","published":"2026-07-16T06:35:57Z","database_specific":{"malicious-packages-origins":[{"sha256":"9df6f21fababcd99ba522d380a0729d35aa4ff44ee2f6612fe75b906da844aee","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-010741","import_time":"2026-07-16T18:54:02.211800559Z","modified_time":"2026-07-16T18:40:35Z"},{"versions":["1.0.2"],"import_time":"2026-07-17T03:07:33.712326401Z","modified_time":"2026-07-16T06:35:57Z","sha256":"9924ec9036b6c4caf7436a5e7ba79ed4e1b31fb1732c884d164c340a6982886d","source":"ossf-package-analysis"},{"sha256":"c1b4ec7d9dfd8f6566efafa88495903265e6c8f4682285066df303a1818f9b1d","source":"ossf-package-analysis","versions":["1.0.4"],"import_time":"2026-07-17T03:07:33.795182982Z","modified_time":"2026-07-16T06:40:57Z"},{"versions":["1.0.2"],"id":"IN-MAL-2026-013090","import_time":"2026-08-05T06:00:40.003075129Z","modified_time":"2026-08-05T05:32:28Z","sha256":"028e218c486ca4c19c3724d6f4cbd363c6aa2f53af732f7ebdc7e06fae914989","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/nordpass/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/nordpass/v/1.0.2"}],"affected":[{"package":{"name":"nordpass","ecosystem":"npm","purl":"pkg:npm/nordpass"},"versions":["1.0.0","1.0.2","1.0.4"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"tlsh":"84a35e1b3dd494f7b1251dbf2e2c498ddb64fc8661b88178a2767827d08747f2aa0336","path":"src/install.js","sha256":"32fb104c032b62551ef5e0d12ab4bf742a5c2d11988e12d302a3b8b8ac748a41"}],"package_integrity":[{"hashes":{"sha512_sri":"sha512-hmzbT6JwynecRXqaGJykUQvg/3S2OGfPl9gZ4ALGsRdULPfPjARrKJ6K+kUdPxnM8/N3pSpx2G2tthbZnA5G2Q==","sha1":"52cd40157263d0cafa2378cb2279c21e84f03929"},"filename":"nordpass-1.0.0.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/nordpass/MAL-2026-10743.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}