{"id":"MAL-2026-10905","summary":"Malicious code in win-build-utils (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (03bd3facc00c36861223058a572fbaa888d815a06c7b309c44639c544c65f1d9)\nThe package name suggests a Windows build helper utility, but no concrete behavioral evidence is available to confirm or refute installer-side risk. No exfiltration, install-time fetch, credential access, or other attack-class behavior was observed. The package warrants human review to confirm contents and intent before issuing a public verdict.\n","aliases":["GHSA-7ffq-88v5-rmwc"],"modified":"2026-09-01T11:45:05.973693441Z","published":"2026-07-20T11:04:39Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-07-20T11:04:39Z","sha256":"7f6c85194f2cc39ade690b7b9a94332657b6251b638d8908080bedf5b98d908f","source":"reversing-labs","versions":["1.0.0"],"id":"RLMA-2026-05653","import_time":"2026-07-20T13:14:53.790441043Z"},{"id":"IN-MAL-2026-013032","import_time":"2026-08-05T06:00:33.27134744Z","modified_time":"2026-08-05T05:24:07Z","sha256":"03bd3facc00c36861223058a572fbaa888d815a06c7b309c44639c544c65f1d9","source":"amazon-inspector","versions":["1.0.0"]},{"id":"RLUA-2026-06552","import_time":"2026-09-01T11:38:20.417964332Z","modified_time":"2026-08-24T17:17:13Z","sha256":"26e3dee77c0d7ff1e6dd5b799e65f48cb574e70615a72d3631410e713de15b7d","source":"reversing-labs"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/win-build-utils/v/1.0.0"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-7ffq-88v5-rmwc"}],"affected":[{"package":{"name":"win-build-utils","ecosystem":"npm","purl":"pkg:npm/win-build-utils"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"hashes":{"sha512_sri":"sha512-ab4OMCFy4pdz5MC7Ea6aK49RMCSbZTiHuPhE+efmgTeDH5XHA8KDd/JmHfmQDRC3Z2vbEocuIc45BSl6L9CraQ==","sha1":"eac5474260e937bbccff8bfcbf2575d0d888841c"},"filename":"win-build-utils-1.0.0.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/win-build-utils/MAL-2026-10905.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}