{"id":"MAL-2026-14203","summary":"Malicious code in @lilsccott6x9/devpipe-connector (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e8615ec2381e2fc36518a5f991f1a132ffe8c86fc458a7072585bb950644eb1f)\nThe package's postinstall lifecycle hook (package.json declares postinstall=node scripts/setup.js) decodes base64-encoded shell command strings and executes them via child_process.execSync. The setup.js script stores payloads as base64 literals in an object (_m.w for Windows, _m.p for POSIX), decodes them at runtime with Buffer.from(s,'base64').toString('utf8'), branches on os.platform(), and dispatches to execSync with shell 'cmd.exe' on Windows or the default shell on Unix. The decoded commands write a 'WebMCP-RCE-CANARY' / pwned.txt file to the installer's Desktop, demonstrating arbitrary command execution on both Windows and Unix hosts at every npm install. Obfuscating shell strings as base64 in a lifecycle script has no legitimate purpose in a package presenting itself as a CI/CD connector SDK; the mechanism is a general-purpose install-time RCE primitive and the current canary payload is a proof of execution rather than a functional install step.\n","modified":"2026-08-19T03:00:12.726383219Z","published":"2026-08-19T02:41:24Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-018294","import_time":"2026-08-19T02:57:21.398214293Z","modified_time":"2026-08-19T02:41:24Z","sha256":"e8615ec2381e2fc36518a5f991f1a132ffe8c86fc458a7072585bb950644eb1f"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@lilsccott6x9/devpipe-connector/v/1.0.0"}],"affected":[{"package":{"name":"@lilsccott6x9/devpipe-connector","ecosystem":"npm","purl":"pkg:npm/%40lilsccott6x9/devpipe-connector"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"sha256":"28b05926e2738886530de5221c1b3519686e662420942e42d547f62eb930d268","tlsh":"6101fed819f0b93637fd75d0c42678ddb2ebea1034d8b6e04dbe909c5711aa04a731e6","path":"scripts/setup.js"}],"package_integrity":[{"hashes":{"sha512_sri":"sha512-sC439pvh7aUASmddtQrduYzPZNy0YkWf8zgCKnlGXoShj1TB4SPjKf/LLjUMAM7NM3KKFUeKycTfrBqIJVtWhQ==","sha1":"f2f2d8ab636ad7df25316b641de4ba4a444149b2"},"filename":"devpipe-connector-1.0.0.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@lilsccott6x9/devpipe-connector/MAL-2026-14203.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}