{"id":"MAL-2026-17474","summary":"Malicious code in core-js-gnz (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (dc57686b95f827f2c3b0501d97b6575e077247255bf5d4227ae9bc8bedd43937)\nOn install, package.json runs `node init.js` as a postinstall hook. init.js collects host identifiers (os.hostname(), os.userInfo().username, os.platform(), os.arch(), node version, OS release) and POSTs them to https://helper.businesse-vip1.workers.dev/report, then fetches an AES-256-GCM encrypted blob from the /e endpoint on the same host (with TLS verification disabled via rejectUnauthorized:false), decrypts it in-process, writes the decoded content to the user cache directory as exec_runtime.py, and spawns a detached python3 process to execute it (stdio:'ignore', windowsHide, detached:true). Execution is gated on developer-machine heuristics (presence of Desktop/Documents/Downloads in the home directory) and rate-limited via a hidden ~/.cache/core-js-buffer/.init_check marker, with cover-story identifiers ('Environment check', 'TelemetrySender', a BIP-174 seed label). The package name and README advertise an unrelated hex-buffer utility, which does not match the observed behavior.\n","modified":"2026-10-04T23:30:05.643314303Z","published":"2026-10-04T23:15:14Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-10-04T23:16:30.779270217Z","modified_time":"2026-10-04T23:15:14Z","sha256":"dc57686b95f827f2c3b0501d97b6575e077247255bf5d4227ae9bc8bedd43937","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-020892"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/core-js-gnz/v/1.0.0"}],"affected":[{"package":{"name":"core-js-gnz","ecosystem":"npm","purl":"pkg:npm/core-js-gnz"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"init.js","sha256":"5dceefe88e4597f230e83c98adc40db14a8ffc4cfdc5659c603edc2febc2d51e","tlsh":"26a12ef669f2b23032b2f25d826f900aa267f113314aea90f85c72501fdd02c47a5df8"}],"package_integrity":[{"hashes":{"sha1":"935453fb72dd574e88dd17066a04555f789e8e24","sha512_sri":"sha512-5nE0tAU62fBZaX9+B9T2l31oiR2z2vm0vG+K/09gi4c4uz08jk1F9d91xxuuL7/uPelHHI7689z7oqOG3QWwUA=="},"filename":"core-js-gnz-1.0.0.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/core-js-gnz/MAL-2026-17474.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}