{"id":"MAL-2026-14290","summary":"Malicious code in anhn-cli (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7b0f11f74231c27bd3e3ac41dea5290466f042224f64547d88a328d6b87cf657)\nbin/install/install.js appends a heavily obfuscated top-level IIFE (obfuscator.io-style rotated string array `_0x240a`/`_0x4963` with arithmetic index decoding) after the benign install() helper. The payload queries public Ethereum RPCs and etherscan.io for transactions from the hardcoded sender address 0xa322E5f3..., decodes the transaction `to` field as an IPv4 address, fetches an XOR-encrypted body from that host, and executes it via `eval(prefix+xor(body))` and a detached `spawn('node', ['-e',...], {detached:true}).unref()`. The package's main entry (bin/index.js) unconditionally requires./install/install, so the IIFE runs whenever the package is required or the CLI is invoked. The attacker controls the fetched payload by publishing new Ethereum transactions from the sender address; there is no version pinning, no signature check, and the destination host rotates on-chain. Decoded strings inside the string array include `eth_getBlockByNumber`, `etherscan.io`, `eval`, and `spawn`.\n","modified":"2026-08-19T09:00:19.339383760Z","published":"2026-08-19T08:37:09Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018413","import_time":"2026-08-19T08:48:53.993969046Z","modified_time":"2026-08-19T08:37:09Z","sha256":"7b0f11f74231c27bd3e3ac41dea5290466f042224f64547d88a328d6b87cf657","source":"amazon-inspector","versions":["1.1.4"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/anhn-cli/v/1.1.4"}],"affected":[{"package":{"name":"anhn-cli","ecosystem":"npm","purl":"pkg:npm/anhn-cli"},"versions":["1.1.4"],"database_specific":{"indicators":{"evidence_files":[{"tlsh":"08e23284a7d0a440034b6abbbb1bf4e5e96a0cac75844ac7f11dbd84f766327e4f1531","path":"bin/install/install.js","sha256":"edd592deaa4eb1924b0eeaee130c299c39b7d6617e515432037206b75296aacd"}],"package_integrity":[{"filename":"anhn-cli-1.1.4.tgz","hashes":{"sha1":"93dac554ac1d931f434c3786f202b1522f42c703","sha512_sri":"sha512-KYigpzpMwqd5ehpwRrIA4K34sZd/md0hak//yjK3nhQeE+LivicgeeXKJ210JFBwoK3RLxHofeCnhefmzztksA=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/anhn-cli/MAL-2026-14290.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}