{"id":"MAL-2026-12339","summary":"Malicious code in async-mutex-hook (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (624c93cbd007656467757c5504db29971b220bc36685eda2af6a1d1390715133)\nPackage is published under the name async-mutex-hook and self-describes as a Promise-based mutex library, but ships no mutex implementation. Its exported getPlugin function issues an HTTPS request to the hardcoded bare-IP endpoint https://46.183.25.232:45000/icons/108 and passes the response's `credits` field to `new Function('require','module','exports',...,'Promise', data.credits)`, executing attacker-controlled JavaScript with full Node.js privileges (require, process, Buffer, and shipped dependencies injected). The declared dependencies (@primno/dpapi for Windows DPAPI, better-sqlite3/sqlite3 for browser cookie and login databases, node-machine-id) are unrelated to any mutex functionality and are the standard building blocks for browser-credential and DPAPI theft, matching the capability the remote payload would need to invoke on the installer's host.\n","modified":"2026-08-05T13:34:58.286030925Z","published":"2026-08-05T12:47:07Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014760","import_time":"2026-08-05T13:08:44.389086986Z","modified_time":"2026-08-05T12:47:07Z","sha256":"624c93cbd007656467757c5504db29971b220bc36685eda2af6a1d1390715133","source":"amazon-inspector","versions":["2.1.0"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/async-mutex-hook/v/2.1.0"}],"affected":[{"package":{"name":"async-mutex-hook","ecosystem":"npm","purl":"pkg:npm/async-mutex-hook"},"versions":["2.1.0"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"tlsh":"30c1616546fa31a36a67e4eef30f10027165e313365de971f48e42902fca568e5f24e8","path":"index.js","sha256":"ce2c680ca6b7355d73cbc131465fc6b2f2508f367b57ecb27a3b05e6e247213f"},{"tlsh":"46f04911ce21deb314d615976828809aa150d91b8d00fc0c339e866d4f0e56f36fb26c","path":"package.json","sha256":"3c35cd56d5f1c18ccd5452864e507aa31c239ec87b004b49d272577ff3f0ba83"}],"package_integrity":[{"hashes":{"sha1":"38c760af73f28532e5f071265c441b3d2b753a52","sha512_sri":"sha512-j+XJiupEbofuKM1EDdkiVio2yzPClLFcVmiT09Skfg7TuB2mWW+iiM/cX248OrZs0yP3MLhHQdspgnX6EWM9mA=="},"filename":"async-mutex-hook-2.1.0.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/async-mutex-hook/MAL-2026-12339.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}