{"id":"MAL-2026-15901","summary":"Malicious code in net-util-y8 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d1e81ce327647324756e0ea15d1016d45cd5bb092dd0099418ba2db59eca98a7)\nThe package has no real functionality: index.js contains only an empty comment and package.json declares no exports or lifecycle scripts. The `description` field in package.json is a ~56KB base64 blob that decodes to a ~42KB POSIX shell script implementing an XMRig Monero miner dropper. The decoded script preflights curl/wget/openssl and perl (installing them via the system package manager with root privileges if missing), fetches XMRig binaries from gitlab.com/albertotrindade131/al and a ghfast.top proxy in front of github.com/lucas77335/xmrig-amd releases, points the miner at the pool xmr.kryptex.network:8029 with a hardcoded Monero wallet address (883kAB7Ufo...gBCFH), and includes routines to kill competing miners and mask its process name. The script also references a sibling package `net-util-x7` and a registry-latest lookup at registry.npmjs.org/cbc97b7a/latest, indicating this is a staging component of a multi-package cryptomining campaign. Encoding an executable payload inside the manifest `description` field is a smuggling technique to keep the payload off code-scanning paths while still shipping it in the published tarball.\n","modified":"2026-09-04T04:30:05.866309201Z","published":"2026-09-04T03:46:33Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019458","import_time":"2026-09-04T04:21:21.252095623Z","modified_time":"2026-09-04T03:46:33Z","sha256":"d1e81ce327647324756e0ea15d1016d45cd5bb092dd0099418ba2db59eca98a7","source":"amazon-inspector","versions":["1.1788432509.0"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/net-util-y8/v/1.1788432509.0"}],"affected":[{"package":{"name":"net-util-y8","ecosystem":"npm","purl":"pkg:npm/net-util-y8"},"versions":["1.1788432509.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/net-util-y8/MAL-2026-15901.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"net-util-y8-1.1788432509.0.tgz","hashes":{"sha1":"d21b5dc29107c119ba0ef3311402d07cf762ffd2","sha512_sri":"sha512-FvnDMun9V+7IkOzv5sZahVvKh0OgZd2EBk7h/JiKL0aI3zczdZwV3fDQfSrLYIL5pP9OdmZW17wA66Qpywx7mA=="}}],"evidence_files":[{"tlsh":"f84318b7dd473e0d8b29a4121ddf09d95e0d238f307240cfa65bbb49511f1aeaac41aa","path":"package.json","sha256":"6559f7a385676256d43cc624e79dbb704edf15c1d6832568a39f5f5d2608398d"}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}