{"id":"MAL-2026-14280","summary":"Malicious code in mutex-core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8c015af803d9d4adc7d0578dc27795ebaef48e6ce25e9bf715b54af1e4991999)\nThe package is published under a name resembling the popular async-mutex library and, beyond advertised mutex functionality, contains a staged loader. lib/Mutex.js's Mutex.prototype.runExclusive checks whether a callback's meta.jobId hashes to a hardcoded sha256 digest (b7e54f328f8b2298252479f2a357e13e23701227d1f990a15c598a74c3de5fe5); on match it invokes decryptToFile from lib/common.js to AES-256-GCM-decrypt the sibling file lib/withMutex.min.js — a ~17KB base64 literal decoding to ~12.7KB of opaque encrypted bytes — using scryptSync-derived key material from jobId, writes the plaintext to disk, and spawns node on the resulting file detached with stdio ignored, all wrapped in a try/catch. lib/common.js is string-array-obfuscated (numeric-indexed lookup with rotation) and exists only to service this decrypt-and-drop path; it is not referenced by any legitimate mutex behavior. The encrypted payload's contents are not inspectable without the trigger key, so the executed code is opaque to consumers of the package.\n","modified":"2026-08-19T08:34:48.684106151Z","published":"2026-08-19T07:52:21Z","database_specific":{"malicious-packages-origins":[{"sha256":"8c015af803d9d4adc7d0578dc27795ebaef48e6ce25e9bf715b54af1e4991999","source":"amazon-inspector","versions":["2.1.2"],"id":"IN-MAL-2026-018394","import_time":"2026-08-19T08:15:31.859672251Z","modified_time":"2026-08-19T07:52:21Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/mutex-core/v/2.1.2"}],"affected":[{"package":{"name":"mutex-core","ecosystem":"npm","purl":"pkg:npm/mutex-core"},"versions":["2.1.2"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/mutex-core/MAL-2026-14280.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"path":"lib/Mutex.js","sha256":"ad626b78f2f5ca13ad8b255a13b912bb1db69bfd564a91c99f7e39c97e4d0e13","tlsh":"cf51e14457f3e516527370db873b9009b07c8037124cc9a5f94dc2ea6f5606887babec"},{"path":"lib/common.js","sha256":"22c0e6da62021cce16f293679c859c2b6ab7920309f7a4109d03ea7b59d219d1","tlsh":"2121f4993ecabcb4536a48da44ba68175c58fec06c0e73818157d1c53c79f60d0677bc"},{"path":"lib/withMutex.min.js","sha256":"5d39fae4eab3c03b37af85906eee5c3a781992ab4c9bd7191734b337705cb484","tlsh":"ad72d0150dbac7948e172328a68fbeaa32d4845f32c1c261462dcc1f513e0737dafa35"}],"package_integrity":[{"filename":"mutex-core-2.1.2.tgz","hashes":{"sha1":"32447098953e7386ef1bdfaa646f60b55e016d34","sha512_sri":"sha512-ulh4yYf2a3lOnwriM7XGiYnb8BK9qVpTRkymwkSiM8mmSZRuvko+Kuevm/bjhIvs+7HzOH31oUSDAqd74HQirg=="}}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}