{"id":"MAL-2026-11539","summary":"Malicious code in entropyeasybots (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (82e7d0cd2ef4870fdc4484c815737ade78e04bdac4843df02f5cf876cfa3dbaa)\nindex.js decodes a base64-obfuscated IP (85.137.253.124) and connects a spawned /bin/sh subprocess's stdio to a TCP socket at 85.137.253.124:1111, granting remote shell access on the installer's host. package.json declares `postinstall: sudo node install.js`, and install.js uses node-linux's Service API to register a systemd unit named `CustomBot` that runs index.js with maxRestarts:10, providing root-level persistence of the backdoor across reboots. The C2 IP is stored as a base64 string and reconstructed at runtime to hide the destination.\n","modified":"2026-08-04T23:04:40.320773159Z","published":"2026-08-04T22:07:52Z","database_specific":{"malicious-packages-origins":[{"sha256":"82e7d0cd2ef4870fdc4484c815737ade78e04bdac4843df02f5cf876cfa3dbaa","source":"amazon-inspector","versions":["2.0.2"],"id":"IN-MAL-2026-011343","import_time":"2026-08-04T22:30:11.842874863Z","modified_time":"2026-08-04T22:07:52Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/entropyeasybots/v/2.0.2"}],"affected":[{"package":{"name":"entropyeasybots","ecosystem":"npm","purl":"pkg:npm/entropyeasybots"},"versions":["2.0.2"],"database_specific":{"indicators":{"evidence_files":[{"path":"index.js","sha256":"52875c52db0fbcb6860cbea25050d34206496f2abf4ba04238e1161d0f2e2da0","tlsh":"8401ce58a4b62579107330a1c93fca1b2b6b40263202e1b0b25c44d91fa761d623bbde"},{"path":"package.json","sha256":"63a6c73660e3151b802efad570e689925545a0c6fb111103829c1d3c3ed74be0","tlsh":"e9d02b040c21a73339c5aee96c63504fbfcb4758510888180397411413ed7bf44bf30a"}],"package_integrity":[{"filename":"entropyeasybots-2.0.2.tgz","hashes":{"sha1":"55de0d7a5bffa27272270be32a98240147639671","sha512_sri":"sha512-b5cUb/ELxghXMkhHqmXFdPsCoBstv58IzfjQz+hOs28Jf7P5nsq2uoj5tQyA5ZBAroyDGc7DxQmNKdjThm4sbA=="}}]},"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/entropyeasybots/MAL-2026-11539.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}