{"id":"MAL-2026-13360","summary":"Malicious code in uzair-rajput-new (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (70070ac11c08aa4d23d214d9539b96f97c6bd6eaa56bb6561160d02bd6d52632)\nThe CJS entry (dist/index.cjs) assembles a scrypt password by XOR-deobfuscating three sibling byte arrays (_a.cjs, _b.cjs, _c.cjs) with distinct constants (17, 91, 53), uses that key with createDecipheriv('aes-256-cbc',...) to decrypt an embedded ~5KB ciphertext, and passes the plaintext to new Function('module','exports','require','__dirname','__filename',...)(...) — executing opaque code in the consumer's Node process on every require('uzair-rajput-new'). The parallel ESM build (dist/index.js) is a plain color-gradient library containing no such loader, so the obfuscated dynamic-code loader is not a legitimate transpilation artifact of the declared TypeScript source. The split-key layout, XOR obfuscation of key material, and AES-encrypted payload together constitute an anti-analysis packaging pattern whose only effect is to hide arbitrary code executed at module load.\n","modified":"2026-08-05T18:19:47.691982636Z","published":"2026-08-05T17:38:18Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015838","import_time":"2026-08-05T18:07:51.171790787Z","modified_time":"2026-08-05T17:38:18Z","sha256":"70070ac11c08aa4d23d214d9539b96f97c6bd6eaa56bb6561160d02bd6d52632","source":"amazon-inspector","versions":["1.0.1"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/uzair-rajput-new/v/1.0.1"}],"affected":[{"package":{"name":"uzair-rajput-new","ecosystem":"npm","purl":"pkg:npm/uzair-rajput-new"},"versions":["1.0.1"],"database_specific":{"indicators":{"evidence_files":[{"path":"dist/index.cjs","sha256":"3f564f0df5a16009ca450256e3e5e0457dcd9202e10f79567b7b2aa354d888b2","tlsh":"f1f1ae461cbe00a6f8bac1b27932e14d1df5dbb4345f940a06ca9eca449661e90f0b1d"}],"package_integrity":[{"hashes":{"sha1":"9ceb68689aa14def50104f5cf39cc00d5940825e","sha512_sri":"sha512-+11JQNfleMzuhHqgU9nYTD2cLVCe0j2q+4TqD6Fn5w1dwhW6Xqvi9SmqYKhzk/F0rblaJ0WpGj389eJHBjBijw=="},"filename":"uzair-rajput-new-1.0.1.tgz"}]},"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/uzair-rajput-new/MAL-2026-13360.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}