{"id":"MAL-2026-13989","summary":"Malicious code in @secauditb20y/sec-test-r3b (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (df7034b94531c8be5e9141c7a5cf73f552486c1b307672346a0e646e60207b7c)\npackage.json declares a postinstall script that runs `node -e` to invoke fs.writeFileSync, creating /tmp/PWN_R3REAL/FIRED on the installer's machine when the package is installed. The package's main module only exports the literal value 42 and ships no native build or legitimate reason for install-time execution; the postinstall exists solely to demonstrate arbitrary code execution on the installer host at `npm install` time. The behavior fires automatically on default install and writes to a path outside the package directory, matching the shape of a proof-of-execution beacon. The package name and description self-identify as an authorized security test, but self-labeling is not a mitigation and the code path is functionally identical to a dropper marker.\n","modified":"2026-08-13T22:00:13.225198899Z","published":"2026-08-13T21:23:10Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-13T21:50:19.940159105Z","modified_time":"2026-08-13T21:23:10Z","sha256":"df7034b94531c8be5e9141c7a5cf73f552486c1b307672346a0e646e60207b7c","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-017707"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@secauditb20y/sec-test-r3b/v/1.0.0"}],"affected":[{"package":{"name":"@secauditb20y/sec-test-r3b","ecosystem":"npm","purl":"pkg:npm/%40secauditb20y/sec-test-r3b"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"sha256":"ab342eb7ca5411389931088dec31d592ac3b5319ccee93b8e50e4ff3bf7f95ad","tlsh":"35e07d240e50533338c4467615b6d50a66a1cc2b0004740447c7206951cebb79bbbb0d","path":"package.json"}],"package_integrity":[{"hashes":{"sha1":"b61fbcce4a59bfae417b8280c35498ea3ff70ed6","sha512_sri":"sha512-qGwpSVqg8lA8Xk6rNsjOSyMPjVn/jFe/6eQlKT0YuQHyIbTsymZn74SAjYqMDeVY8r2ztCjQOU7wS/R5XC6cYA=="},"filename":"sec-test-r3b-1.0.0.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@secauditb20y/sec-test-r3b/MAL-2026-13989.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}