{"id":"MAL-2026-13404","summary":"Malicious code in tsihealth-client (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (554372f29af60ad8e6e5a33171a736baddcc652772b0452c81a4010d3f1e5218)\nindex.js is a top-level self-decoding IIFE that XOR-decodes a URI-encoded payload keyed on the enclosing function's own source and eval()s the result at module load; the decoder aborts with 'the code has been tampered!' if the source is modified, and a banner asks readers not to crack it. The decoded payload is opaque and cannot be audited without executing it. The package's own metadata and typings describe the runtime behavior: package.json advertises it as a 'client (provider) for the tsi-vpsremote control server' that 'stays alive to run commands pushed from the server', keywords include 'shell', 'ssh', 'remote-control', and 'agent', and index.d.ts exports a ProviderHandle exposing a ChildProcess named `shell`. Calling the exported provider(url) at runtime therefore establishes a persistent connection to a remote server that drives a local ChildProcess on the host running the package — a network-to-shell control channel with full-host command execution for whoever controls the paired server URL.\n","modified":"2026-08-06T23:50:24.025227484Z","published":"2026-08-06T12:56:31Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-06T13:09:08.990017972Z","modified_time":"2026-08-06T12:56:40Z","sha256":"554372f29af60ad8e6e5a33171a736baddcc652772b0452c81a4010d3f1e5218","source":"amazon-inspector","versions":["1.0.1"],"id":"IN-MAL-2026-016271"},{"sha256":"de03422542ea1313c1811700d7fde62bf857f1dbf7a465524389fef2b5a71414","source":"amazon-inspector","versions":["1.0.2"],"id":"IN-MAL-2026-016273","import_time":"2026-08-06T13:09:09.178685907Z","modified_time":"2026-08-06T12:56:55Z"},{"import_time":"2026-08-06T13:09:08.893548769Z","modified_time":"2026-08-06T12:56:31Z","sha256":"5c50feb1534833507a497685c4dac21c981a94e926baa64cc890b1f0334304cc","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-016270"},{"sha256":"8167e7c1c94496306106c7d41fd67780b35bb680a78875e75a9087d7c9a4092c","source":"amazon-inspector","versions":["1.0.3"],"id":"IN-MAL-2026-016272","import_time":"2026-08-06T13:09:09.084996356Z","modified_time":"2026-08-06T12:56:47Z"},{"source":"amazon-inspector","versions":["1.0.4"],"id":"IN-MAL-2026-016756","import_time":"2026-08-06T23:25:07.709820657Z","modified_time":"2026-08-06T19:16:07Z","sha256":"68ced4f5310b6def3b9acaf58e8f363ebcc73b248ad207c3ca68841e799815b7"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tsihealth-client/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/tsihealth-client/v/1.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/tsihealth-client/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/tsihealth-client/v/1.0.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/tsihealth-client/v/1.0.4"}],"affected":[{"package":{"name":"tsihealth-client","ecosystem":"npm","purl":"pkg:npm/tsihealth-client"},"versions":["1.0.1","1.0.2","1.0.0","1.0.3","1.0.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"824a0babe42da4c4b68f85a40137c851bf8f5295563f0cb783940ef68bd7e524","tlsh":"f90384a0579fcc734c3bf02fb58d1d264926af52cce984e522c4934ce7e8b6215669cd"},{"sha256":"ceb2786a3d87883fde45370dc233f6328e9829be746dcef510e72bed0f054203","tlsh":"5e115733c2620d2301b89b14bda44b52f2121b6f20344c0735bb342c4ff7557218eb6d","path":"package.json"}],"package_integrity":[{"filename":"tsihealth-client-1.0.1.tgz","hashes":{"sha1":"9d7e299973f34459d4d185da9c87a54870ad3b5f","sha512_sri":"sha512-XUXDDkvUTndnmfxSqUiZ7AFCIQg+96dVHEFXeo+CUcPiCEQ4MKu9dnQvXbbawdvucnOmC27dboMbeIbEGP308Q=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tsihealth-client/MAL-2026-13404.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}