{"id":"MAL-2026-12183","summary":"Malicious code in nolimit-agent (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9e9510731400dde41fd6705895d15e78bf4fe6f4560162a10bd6016e855f4221)\nThe package tarball contains a hidden top-level directory `.ad/` populated with ~40+ heavily obfuscated JavaScript files (advanced-evasion.js, from-generator.js, phone-validator.js, proxy-validator.js, sms-providers.js, smtp-health-cache.js, socks-loader.js, web-command.js, and x0.js through xz.js). All files use hex-identifier obfuscation (`_0x`-prefixed symbols, single-line minified layout) consistent with javascript-obfuscator output designed to hide code behavior. The naming pattern (advanced-evasion, socks-loader, sms-providers, smtp-health-cache, phone-validator, web-command, proxy-validator) is aligned with SMS/SMTP/SOCKS abuse tooling — bulk-messaging, proxy-chained credential/SMS pumping, and evasion of anti-abuse controls. Placing these files in a dot-prefixed directory hides them from casual directory listings and package browsers. Obfuscation across every file in this directory, combined with the abuse-tooling module names, is inconsistent with a legitimate library and matches the shape of an operational abuse/attack toolkit distributed via npm.\n","modified":"2026-08-05T10:06:11.118570060Z","published":"2026-08-05T08:50:21Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["1.0.343"],"id":"IN-MAL-2026-014437","import_time":"2026-08-05T09:28:10.92695566Z","modified_time":"2026-08-05T08:50:21Z","sha256":"9e9510731400dde41fd6705895d15e78bf4fe6f4560162a10bd6016e855f4221"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/nolimit-agent/v/1.0.343"}],"affected":[{"package":{"name":"nolimit-agent","ecosystem":"npm","purl":"pkg:npm/nolimit-agent"},"versions":["1.0.343"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"tlsh":"b1921a906380329e1383ebb7b92764d1d56a54b739448c8773d87d1cb8e8a5debd8b30","path":".ad/advanced-evasion.js","sha256":"07e5a7cd0de08d118c197cacddc941e19ac0331998d49525cdfa4531f948d5d9"},{"path":".ad/from-generator.js","sha256":"abd3851cd556e59fd5a791ff1e40e27c6ca12b29f4dd03f5fdb03dc17cfdd1ca","tlsh":"f8f1a5447e85368a7b4b0ed3353b68e4dc095c877d64ac4ab9b4b854ac019bdc0eeb34"},{"path":".ad/phone-validator.js","sha256":"26e33c23f01a846cfdb358498845c17fa33759560e7bc4ba4686f17e95c3326c","tlsh":"75f1c890a6453160eb4f6beb2b13b0d0e45d58be7ba41cced16878cdad616b2d2d0e30"},{"tlsh":"8622f84067c02180b7072ff3ad3750e1da3c1d4b7a50988fe448a8acf922d16ebe9a30","path":".ad/proxy-validator.js","sha256":"7b18f57d7d2ff0a5ac973eb3cb26faf90894a456e8fd1f0156a01e5102a12420"},{"tlsh":"9e82f7cdd8c275855f8e2ef7bb03e4d1e17a044e75488caee104bc1caa62a21d7f5a74","path":".ad/sms-providers.js","sha256":"50429d4bf5b956dad6912c203c722ec1f540fdf4a434c0a3a784675127385262"},{"sha256":"d2ff094083cf5cef00ad7cc23dd38161844b18d8eafaa424d9f720c651d54bf6","tlsh":"3332b7407684a9c1bb875ffb7a23b0cdf5799c4e7480058bd28878692ee1977fac0531","path":".ad/smtp-health-cache.js"},{"tlsh":"4af1855077d137d9974b46f3931e62e3e61e985b394c4c5fe010aea96ca1038d3dea34","path":".ad/socks-loader.js","sha256":"dbcdef1589fe11f5d84f02044686c9d3ad81d372c168e8105279ec6f3dd13aa1"},{"tlsh":"309218a866c4b09c574613f33e2764b8eb6829567049c70be4a0fcbc2e9674ae5ec131","path":".ad/web-command.js","sha256":"3f483f30d554feb8752200c5a4611f297882f138436e2f89ef0165ca2908f283"},{"path":".ad/x0.js","sha256":"c2f38a28e27a804a7ae06a24581768d6dd02dbbae7ce21ed92ea870daca8ee22","tlsh":"6983d96cdad4384a774217f7ff2760c2e64e1869b484e94be9d4bc0c14a2672f6e4b31"},{"path":".ad/x1.js","sha256":"410030d5032d83d1af84cc5eb2997e512aabb2952d8d507eb24bbb1362ded5c4","tlsh":"4ba3c68897c439e9b34a2bfb761371d1e94948aa34c49dc7f4c4b81cb499a3bfad5130"},{"path":".ad/x10.js","sha256":"d23f9179efabd8dc94296f7ce6b528cfc516054bf307c4f28da23e835ff1bc60","tlsh":"e562c855a7c03c9a674f4ffbb63370d1c65c449a744c8806ea84bea96cfa617f8d4930"},{"sha256":"14c7133a735d4d8d3aa8f12263312ac8a863c77004f2fe3c6580a4cb3ec15c36","tlsh":"c592e844b3c1b480734a5edb7327b4c0e45da49e78895d8ff8887e2e3d25616e2d6b30","path":".ad/x11.js"},{"sha256":"21f709a72d6f337f16fe8de87b93958ced524a650469617d4c74842d831245fe","tlsh":"b5e2c706da843ed1139f5ef77662b0e1c52a08c5b214cd77b888f86e1ae5b27e5c5630","path":".ad/x12.js"},{"path":".ad/x13.js","sha256":"5782fe40eab5808037c6bfa090c4d29df76734392f70f61b27e1c0bd714c15f8","tlsh":"f852d7a06bd07060832f47eb6786e0c0d22b968e746a4c9df989781c6c35e69cde6735"},{"path":".ad/x2.js","sha256":"dbd5be6c96b8e6bb53ba088f52f6710b35361ac6fcfa554fbc0a8466d664c050","tlsh":"4623d6982e95fa84a34a37e77e12f0f7e06b49597048094be8d4bd1c7897623e5ec730"},{"tlsh":"cb92d740a390255c234b1ef73e1375d0d95b186e3c898d8ff8a8bc1d6aa9712f1fa231","path":".ad/x3.js","sha256":"3b4434a74cdb2eac75b9905d9865ac98a3299fafa1b769732c7a20928997dde1"},{"tlsh":"1b42b522bac9788433465ff73f2b9cf5e62d848d38440d8f94d9f9086c55ab1e6d8632","path":".ad/x4.js","sha256":"620d15b1b597635c00c255b032f70ab83060eab010a83a4f238b339e968edbf8"},{"path":".ad/x5.js","sha256":"2531db9a447da5c933482363b0cb19bda8bedb470db777221163797518193bb2","tlsh":"8c02e97879c171907f416beb650b78f9d619084638a5cd0eb145be3dfceb11ad5e0a30"},{"path":".ad/x6.js","sha256":"16ee4dbbbf83300217f80cd097886ea633efb2fc53f1dc9b1913dd3eda5c58dd","tlsh":"e8d2d690629431c0334a16f7b23b72c4f65e944e3d98ac87fa90be5c6972626e3d1f35"},{"sha256":"635d4a5924ed8e3a6d63b52e0be0eb74764ddaaa3f70b93e3e725653b0b95752","tlsh":"1d82fa5657d52d48a70362ff312b94e2c26c4881370a0c46e9b4ec3cbcea687fdd62b5","path":".ad/x7.js"},{"path":".ad/x8.js","sha256":"6358436c31c85e88ff76c6ac2e1fd546aafdffc718bf6903401f6eeaadcfb93d","tlsh":"a042b7247ba475405f4b5feb6333b0d1e90d895b38c44606e4987da83c61326e7f6a39"},{"path":".ad/x9.js","sha256":"135231c5cabf589aa8c4b234c61f86369fd6a3ac9f6341914c5d346872d70991","tlsh":"1f434d78e280e55f9fe36ef72a02b09ed3991cdd774588b9b5847c0ce651236e4a0633"},{"path":".ad/xa.js","sha256":"3ed4dc717288850e77a178a850fe8829a1225143e02a94d463f355c53a282571","tlsh":"e6b2f89c6658659513461ffb7f11b0edf54e8c6a7888888be2487c8c3d92722dfe8c35"},{"sha256":"cabcdd9baf6a127f9150674d008980998f2c77d6070bd324159af99910e6a438","tlsh":"72d2f890f747fca8130eabfb3b23b0d0d65756e664984947e080b84d79d875ae2ed630","path":".ad/xb.js"},{"tlsh":"0072a541b3806dd43b070bfbb60670d1e29e68ad7a5d0c4bb49c3d9e18f9a16f2d9931","path":".ad/xc.js","sha256":"87a2d0e0f9a7b95fcaa4f9737d84bd9222b7f57d34a1e81fb3b0c502aebb1b7b"},{"path":".ad/xd.js","sha256":"ce2ed4c1573110a6a51997e8f595649a1bbd731a61d421cb30805801a78283c4","tlsh":"32e23c80a7e636e833472bfb7e7260c1d69d945d3901884bf9887d2c7494b16eae4634"},{"sha256":"e4ffaf208c4968aff98244a319ddbaf6e54f67dc19cc601d454961029233c6ba","tlsh":"2ad219e0e3c129d423075ff33f37b1c1e64e4819387a416ad588e91eb49a16bd6f8a35","path":".ad/xe.js"},{"tlsh":"6453396062993995370366f73f2271f2f26a481e3899489bf9943c5c748e633e7f8931","path":".ad/xf.js","sha256":"ad9c48709cfc504fd682bb87cafc5ef2412c4f7ec5eba227a23f8b93bd05c8a0"},{"path":".ad/xg.js","sha256":"b1b740a9f6ce96ecbe29d1344d425d9054f583a496073196125b66353b37c227","tlsh":"e4229490778039a52b471ee37a2650d1ee1e499a398c9447fbe4bd483db0e23e4fd634"},{"sha256":"8ca6c9c01b7d4da19fbdfb7d1bfe00ce79cba229202efe0cf956492ed8e89bb5","tlsh":"d64285107ae03fb033823afbb37b60d5e199549b39a5088bf454fc4d6896915f9e5b30","path":".ad/xh.js"},{"path":".ad/xi.js","sha256":"3613e790a3eef651e6412582686d0bd77457ea436864be3cbd6f77d75b39d2e0","tlsh":"9142b640b5c4fd8c139b57a7b632b4e0e82a4b9b38499b07f1d0bd9c2f96522c5dca34"},{"path":".ad/xj.js","sha256":"a890cf293f05c159072b037e0d3688f47acee3c7d968534b4271d7c3bff25199","tlsh":"3592e810b7d02994b3875ba7f323a0d6e0564c6678d49e87f694bd3c5c89637e2e8b30"},{"sha256":"2bed8c166d876ac1064ca1ae9a0e00664fcd68ccd6cad453357a584ae57a85d8","tlsh":"bfb16254a7803aa15757abbb392770d4da3d58933dac484fe500ecc48deaa01fbf5a30","path":".ad/xk.js"},{"tlsh":"3f22a410e5d435986b471aeb3b32a0c0e64d9c9f3518ac97fe85bc187462731e5eee32","path":".ad/xl.js","sha256":"8e9764d04b397cccbde00f0b30e9b2baca9391d783cc00c3ad666a3db2abb394"},{"path":".ad/xm.js","sha256":"8c5863324650927a402ebd80fb4739ade2cc48bcc9928c966a931e832b00e747","tlsh":"680273c4b9b87469624b6ff37e5372d3d44c58e63465888fe044a83e5ee5a16c1f1e30"},{"sha256":"479fe112fa8362540e1690259321e60b618b987183af64a47540bf0fbf596af2","tlsh":"f1b2c544b34c2cd693cb5af7eb36e0fae625ab567908485ae1807c3e8152013d7e8637","path":".ad/xn.js"},{"path":".ad/xo.js","sha256":"09e4e3eeef7d10bc93d79d297408d586aaab10cd6c80a7b3a4ead91762beafe5","tlsh":"6a92d6c8e3d438d463095ef73d27f2d9f00a5d9d384c8c6be148695c79a2216e5faa31"},{"tlsh":"f8b2299aa195648d034f57f77127b8c1c12d5cda3848e8dbf8b4fd4d69152b8e3c8a38","path":".ad/xp.js","sha256":"95e0d55fd291a9db2bc956e11b154e2e92e35248df90628985bb4774a6772b29"},{"sha256":"5d4312f4975c1dc64f0c302541e77c012ba670ea3783b9caf24b598c76ab068c","tlsh":"04421910b3d530a7671b57fbb22770e5e05a4946bad5889bf4c02cbd786162be2d8f30","path":".ad/xq.js"},{"sha256":"7d34af1030081d54eb373ace973cbc71a98e9e175e60a1825b14c7a39e8a9bab","tlsh":"72922988f3d17dd473025bf3b123a4d1f69d64873c88889be5587c0e65e822be5e6a31","path":".ad/xr.js"},{"tlsh":"32f2c6c921803564a38b3fff6e2326e1c69d484d7d46898fe518bd5c29e2913e7f8934","path":".ad/xs.js","sha256":"06bb2ca0547c5a3c8529f7b59a59c4fb5e9f9c5768e05ccd55cf2384cecb8aec"},{"sha256":"e8d9e7929592a35ca43cfc01758397e28fb33fa323e538d3ef92edcf5a935750","tlsh":"e292f90076d078287752ced7353268c3c5cda4ade1490a16b694bfec2d78923efe9530","path":".ad/xt.js"},{"path":".ad/xu.js","sha256":"96819970168fcafebb35c57de49d4e909b414761611e7b616777b09ad9aa7728","tlsh":"aaf2c6c0a6663c5953066ffbbf2a70d2f66f4989348c4826e9943d1d7cc5232e6f4a31"},{"sha256":"9379c0c2a92309a1ad8fe0236729448c1f95955923c9b8cc475aae826eeebd4f","tlsh":"1ba20980e7c23e95730b1fe7ba1374d2ed5d081a394c8856e6e46d1d3d56722f8e8a30","path":".ad/xv.js"},{"sha256":"38967965969b01fa73d98952fbd6cc15bf441f8ce33717c4113a0f028c5d7aed","tlsh":"4082c544b2c438d137471fff7613b0e5d488591f786e869af1a87d28bca2626f1da930","path":".ad/xw.js"},{"path":".ad/xx.js","sha256":"ee3e244f6067b4acd6c3e7bab0df149e9e8f14ef9a38886df45ebcc77ae1c4eb","tlsh":"01127550b3c27d8067a30fe7b21764c8f22d58d679d84407da59bc285ce2b51e2d9b31"},{"tlsh":"1e323e947ec4344e521773ff622a92b0d71988163c5c9f99b4b43c9a3650a2fd3db632","path":".ad/xy.js","sha256":"ea2df85be2bbf22adf7a82e8048a42aff1a16e6ae0b10bda023964f093420758"},{"sha256":"dedac0d94d4e1e26031e90c213e5d37e9887a928bb439111a97b27acf326f58b","tlsh":"27822b1653a87490a71ba6ff7a1351c0cd6ba44f778c880ff5d4b8186ab5213f2e5e32","path":".ad/xz.js"}],"package_integrity":[{"filename":"nolimit-agent-1.0.343.tgz","hashes":{"sha1":"ee3a2593f2949fef272d1ae191b91cd261b2df58","sha512_sri":"sha512-UXQYtefEwji2iDlqSPqvBIvobuxTSv4U8Ab2tMQowfbrhZIybzSPkEC2T4A2TDoEJvG3UlEad1F+WESyfk66Rw=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/nolimit-agent/MAL-2026-12183.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}