{"id":"MAL-2026-17235","summary":"Malicious code in items-validator (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a8e49b1abd7c566b17104c5a2823251df2ca253a0fa509d7c19db1c1942ad13d)\nOn require, index.js invokes initializeDaemon() at top level, which uses spawn('node', [lib/check-items.js], { detached: true, stdio: 'ignore' }) followed by child.unref() to launch a persistent background process independent of the parent. The daemon HTTP-GETs a JSON payload from the hardcoded endpoint https://game.spawnrealm.com/api/item-realtime?key=abcdef123456 and passes payload.code to `new Function('require', 'module', payload.code)`, executing server-supplied JavaScript inside the installer's Node process with full `require` access. An RSA signature check is performed against a public key bundled in the package (crypto-config.js), so the author controls both the signing key and the verifier and the check provides no independent integrity guarantee. Anyone controlling game.spawnrealm.com — including via DNS or TLS — can run arbitrary code as the installing user for the lifetime of the host process. The package is advertised as a validator library, and this remote-code-loader behavior is undisclosed and unrelated to the stated purpose.\n","modified":"2026-09-28T22:30:06.497768655Z","published":"2026-09-28T22:03:57Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020612","import_time":"2026-09-28T22:18:22.617475759Z","modified_time":"2026-09-28T22:03:57Z","sha256":"a8e49b1abd7c566b17104c5a2823251df2ca253a0fa509d7c19db1c1942ad13d","source":"amazon-inspector","versions":["1.0.5"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/items-validator/v/1.0.5"}],"affected":[{"package":{"name":"items-validator","ecosystem":"npm","purl":"pkg:npm/items-validator"},"versions":["1.0.5"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/items-validator/MAL-2026-17235.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"hashes":{"sha512_sri":"sha512-OTCjY7h3uNpCdIi1nFWcLipqLzc9Cc0stz5EV1bcKuHrerrlVrvDfyQ4DdCUBaU2u0fs8oDBVxaT1Zr+WBF4Jw==","sha1":"5ec9999b56678b98ee984478b8c30c95fb477506"},"filename":"items-validator-1.0.5.tgz"}],"evidence_files":[{"sha256":"ec1f4da780fb3263d71ea555f4bcbdfd8416e98611bd1ad29f3cc053cb8840ba","tlsh":"08a1768ead4b92371eb642f44317602afb5e91832790d255bbcdd34c2fb811c9325cea","path":"lib/check-items.js"},{"path":"index.js","sha256":"32985404eebe9f1ff6887d25b383a152b58522fd8b102385269501d3aa8e29cf","tlsh":"1a11e1e636daa5667c72afe1e9378111be16c11277004011b8edbad70fe19864353cbd"}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}