{"id":"MAL-2026-12117","summary":"Malicious code in 1239i32049i (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6c99f6d077df7b1209fb59dafa8641b14b3947d321379bc6ad22f2660d3d4c7b)\nPackage declares a postinstall script that runs dist/index.js, the sole shipped file, which is heavily obfuscated with javascript-obfuscator (rotated string array, _0xNNNN identifiers, control-flow dispatch). At install time it reads process.env.P, issues an HTTPS GET to https://dropper-crm.vercel.app/api/payload/\u003cP\u003e, base64-decodes the response body, and executes it via new Function('require', decoded), granting the remote endpoint arbitrary code execution with require access on the installing machine. The package name is a numeric string with no documented functionality, no README, and no legitimate purpose beyond delivery of the remote payload.\n","modified":"2026-08-05T10:05:25.361244768Z","published":"2026-08-05T09:04:51Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014536","import_time":"2026-08-05T09:28:23.313852758Z","modified_time":"2026-08-05T09:04:51Z","sha256":"6c99f6d077df7b1209fb59dafa8641b14b3947d321379bc6ad22f2660d3d4c7b","source":"amazon-inspector","versions":["0.1.0"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/1239i32049i/v/0.1.0"}],"affected":[{"package":{"name":"1239i32049i","ecosystem":"npm","purl":"pkg:npm/1239i32049i"},"versions":["0.1.0"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"sha256":"3f2646e7a3539fa37e2d1a31c7ef3ffa1b4516e2ec14a613be0f72089d71c07d","tlsh":"f541fe647fc0361573015eaa3b3a66d6c533d864b8c08d8ba1081a96bd50230cac2f35","path":"dist/index.js"}],"package_integrity":[{"hashes":{"sha512_sri":"sha512-/mWQKJzsXIqYtR/xOVu7vUj5wANpz7NtaS3RHUy/9DN485bFlcHi8i8DbakO8O0/Fyhc1BEF3CCC3rsNEXLW9Q==","sha1":"9de23143f9eaf9fe0f3162701bbc525836ea3dfe"},"filename":"1239i32049i-0.1.0.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/1239i32049i/MAL-2026-12117.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}