{"id":"MAL-2026-12182","summary":"Malicious code in json-validator-utils (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (255dbc17164a6243a92bab0b4d71132efad3028b53e73d7d2924a1d7ccd1e8cf)\nThe package advertises itself as a JSON/XML validator but lib/core.js contains a multi-stage dropper triggered on any call to the public API (validateJson/validateXml). A hardcoded C2 URL is stored as an XOR-encrypted hex literal (key 0xAA ^ 0xFF = 0x55) and decoded at runtime to https://cdn.jsdelivr.net/gh/cryptonomad411/cool-utils/package.json — a personal GitHub account unrelated to the package's stated purpose. The decoded manifest supplies a platform+arch-keyed payload URL that is downloaded to /tmp or %TEMP% and executed (cscript on Windows; chmod+x and spawn('sh',...) on Linux/macOS). Execution is gated behind os.uptime() \u003e= 300 to evade short-lived analysis sandboxes and CI containers. After running the second-stage payload, the Linux branch writes a randomly-named unit to ~/.config/systemd/user and enables it via `systemctl --user enable --now`, and the macOS branch writes a randomly-named plist to ~/Library/LaunchAgents and loads it via `launchctl load -w`, granting persistent auto-start execution of attacker-controlled code on the installer's host.\n","modified":"2026-08-05T13:35:34.441654419Z","published":"2026-08-05T09:09:29Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["1.1.0"],"id":"IN-MAL-2026-014571","import_time":"2026-08-05T09:28:26.684271816Z","modified_time":"2026-08-05T09:09:46Z","sha256":"255dbc17164a6243a92bab0b4d71132efad3028b53e73d7d2924a1d7ccd1e8cf"},{"versions":["1.0.1"],"id":"IN-MAL-2026-014569","import_time":"2026-08-05T09:28:26.51567614Z","modified_time":"2026-08-05T09:09:29Z","sha256":"85655b7c3b2a246107b7e7460f7ad76333a95a7739307941c843dd75464c60f6","source":"amazon-inspector"},{"sha256":"52c9bfd2eda4e95dfe84ebb46bfda7791d386fb26e7d71dcb52b0e2f20e8c628","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-014674","import_time":"2026-08-05T13:08:36.070451805Z","modified_time":"2026-08-05T12:29:08Z"},{"modified_time":"2026-08-05T12:53:20Z","sha256":"7a3bfda78a054ba281a3fcd02dae15433dbe98ab9294cb164756b50cfb28ce6f","source":"amazon-inspector","versions":["1.1.2"],"id":"IN-MAL-2026-014801","import_time":"2026-08-05T13:08:47.483491169Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/json-validator-utils/v/1.1.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/json-validator-utils/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/json-validator-utils/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/json-validator-utils/v/1.1.2"}],"affected":[{"package":{"name":"json-validator-utils","ecosystem":"npm","purl":"pkg:npm/json-validator-utils"},"versions":["1.1.0","1.0.1","1.0.0","1.1.2"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/json-validator-utils/MAL-2026-12182.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"json-validator-utils-1.1.0.tgz","hashes":{"sha1":"48bad273810b4565cdc4739d544782a35cb41af4","sha512_sri":"sha512-hoLOXhoDGjPHpq1Qb8C6vSRk3Gw6oFdhmLCCntmTeFomtTkJP8KLFV6MPrD4GJeXldp9+MwV02rtrkklgqyAEg=="}}],"evidence_files":[{"path":"lib/core.js","sha256":"c8676799ec3c52381dec046be61e7d2db88a436390a8451ab4c5efaf94468cf5","tlsh":"4ed1549925e2e12445f267a98b53c91be91bb02337018458feecc3816ff2565c263efc"}]}}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}