{"id":"MAL-2026-17301","summary":"Malicious code in fs-commons (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f7e82e98343807c39ea786017de4d2a7455815424155ca2a856333d895c8a48b)\nThe package presents itself as a filesystem/data-helper library, but its exported getTransactions()/load_transaction_data() functions are a two-file dynamic-code loader. index.js hides the identifiers 'Function', 'require', 'process', 'Buffer', and 'setTimeout' behind a split-string array and obtains the Function constructor indirectly via globalThis.constructor.constructor, defeating static review. At call time it reads the sibling file models.js, which is disguised as an array of product-record objects but whose `mark` fields are base64 ciphertext. loadConfig()/processData() sort the records by id, concatenate every `mark`, apply a per-count Caesar shift, base64-decode the result, and pass the resulting source to the Function constructor with Buffer, require, and process injected, then invoke it. Any consumer that requires fs-commons and calls getTransactions() executes attacker-supplied code with full Node privileges on the host process. The obfuscation, the indirect Function-constructor acquisition, and the disguising of the payload as product metadata in a sibling file have no legitimate purpose for a data-helper library and are the fingerprint of a supply-chain remote-code-execution package.\n","modified":"2026-09-29T23:45:38.488883722Z","published":"2026-09-29T23:24:17Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["1.0.1"],"id":"IN-MAL-2026-020698","import_time":"2026-09-29T23:39:24.55566493Z","modified_time":"2026-09-29T23:24:17Z","sha256":"f7e82e98343807c39ea786017de4d2a7455815424155ca2a856333d895c8a48b"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/fs-commons/v/1.0.1"}],"affected":[{"package":{"name":"fs-commons","ecosystem":"npm","purl":"pkg:npm/fs-commons"},"versions":["1.0.1"],"database_specific":{"indicators":{"evidence_files":[{"path":"index.js","sha256":"53a5d6dfb922ca08b58e7c5f5975d885009c0b5a89c0c6805d14832962c21fae","tlsh":"a6f10f6839f930248457b07c67eb9449612de0576e9a6ca87f4d83101f7d13ce1f6ba8"},{"path":"models.js","sha256":"65b54532c82855bbc8055c67d9f53854737ce01d3ae6b95fc6577204b81d953f","tlsh":"4e331f3acb780c5b91795a606af50a4af280471f17a16d877fbcd54c8fb1c5b804ab3b"}],"package_integrity":[{"filename":"fs-commons-1.0.1.tgz","hashes":{"sha1":"e50c4a623a29ce361d41d3c91e60ca49bbe9429a","sha512_sri":"sha512-hGqVRB9UCGkZy94B9xU1HFy9BUqXGuSbLyRPQZb9GJYINs48j2o/qE3NOHG7g6eMlgpPTcgDc8fA69dWgFDHKQ=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/fs-commons/MAL-2026-17301.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}