{"id":"MAL-2026-14175","summary":"Malicious code in core-js-gns (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ae5eadad92952db436b03dd9673b34d203d9296b0913389de2aa0d9fef441631)\nThe package's postinstall hook (`package.json` → `node init.js`) runs an installer-side dropper. init.js gates on developer-machine heuristics (presence of Desktop/Documents/Downloads directories) and a 24-hour skip marker, then POSTs hostname, username, platform, architecture, Node version, OS release, and package name/version to https://core-js-buffer.domaup-com.workers.dev/report. It then HTTP GETs an AES-256-GCM ciphertext from the same host with TLS verification disabled (`rejectUnauthorized: false`), decrypts it with a key derived from a hardcoded seed, checks the plaintext contains the cover-story string `TelemetrySender`, writes the result to `~/.cache/core-js-buffer/modules/runtime.py`, and spawns Python detached (`stdio:'ignore'`, `.unref()`) to execute it. The package name mimics the legitimate `core-js` library. Behavior is arbitrary remote code execution on the installer's machine, fetched from an attacker-controlled endpoint at npm install time, preceded by installer identifier exfiltration to the same endpoint.\n","modified":"2026-08-19T00:30:15.889484021Z","published":"2026-08-19T00:00:05Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-018256","import_time":"2026-08-19T00:21:13.710428127Z","modified_time":"2026-08-19T00:00:05Z","sha256":"ae5eadad92952db436b03dd9673b34d203d9296b0913389de2aa0d9fef441631"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/core-js-gns/v/1.0.0"}],"affected":[{"package":{"name":"core-js-gns","ecosystem":"npm","purl":"pkg:npm/core-js-gns"},"versions":["1.0.0"],"database_specific":{"indicators":{"package_integrity":[{"filename":"core-js-gns-1.0.0.tgz","hashes":{"sha512_sri":"sha512-8mdRW8P8HpMMH2Nceh0p3X1FWMwyat3PVOimJ6yX7lxdOk/AEsjrnqT1Ru5LsHSCxr7AJa4mFOCKkwMCInWmlA==","sha1":"40686e28bfe789121574e8841689f62677add4e1"}}],"evidence_files":[{"path":"init.js","sha256":"d2151c94c8fadefee3ffca12886a08e04e24a3f0cffae2dee54b36e1dbd6274c","tlsh":"a4a12ff669f2a23032b2f25d826f904aa267f013714aea90f85d76501fdd02c47a5df8"}]},"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/core-js-gns/MAL-2026-14175.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}