{"id":"MAL-2026-19142","summary":"Malicious code in fcefi-wdojs-util (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (07a00a17209ccc173a7196dd8e97486609819945db1459a5333463be9f6c20b9)\nfcefi-wdojs-util@1.0.0 ships a loader in index.js that reads an undeclared `_bz` numeric array (~1000 bytes) from its own package.json, zlib-inflates it, and executes the resulting JavaScript via the Function constructor on every require of the package. The loader is wrapped in an IIFE that explicitly short-circuits when any of `CI`, `GITHUB_ACTIONS`, `GITLAB_CI`, `TRAVIS`, `CIRCLECI`, or `SANDBOX` are set in the environment, so the payload only runs on developer and production hosts and stays inert in scanning environments. Adjacent to the loader, lib/native.pkg_config is a 2,890,302-byte file containing only hex characters with no printable strings and no relation to native code or pkg-config, consistent with an encrypted stage-2 payload decrypted by the inflated bytecode. The combination — executable code smuggled inside the manifest as a non-standard field, require-time Function()-based execution, deliberate CI/sandbox evasion, and a large opaque hex blob shipped as a misleadingly named config file — is a multi-stage dropper with no legitimate utility function.\n","modified":"2026-11-11T21:15:15.958966905Z","published":"2026-11-11T21:01:46Z","database_specific":{"malicious-packages-origins":[{"sha256":"07a00a17209ccc173a7196dd8e97486609819945db1459a5333463be9f6c20b9","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-022606","import_time":"2026-11-11T21:05:23.410349476Z","modified_time":"2026-11-11T21:01:46Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/fcefi-wdojs-util/v/1.0.0"}],"affected":[{"package":{"name":"fcefi-wdojs-util","ecosystem":"npm","purl":"pkg:npm/fcefi-wdojs-util"},"versions":["1.0.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/fcefi-wdojs-util/MAL-2026-19142.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"sha256":"95618430decba4e2a9241dbc787a7f5aa0a688797e2f648212c7d263f3738ba2","tlsh":"88e0e54cb3b955185891db99a42dae0264f2bad60a958461a654b1832bb0b180b5241f","path":"index.js"},{"sha256":"7419d2631c75a6d36abc4b690f9a86c824d020a3621d24d7420bd7c9357be6dc","tlsh":"610210d61c0378d9b15cc97a107932454494bc23ac56fc8970aa4a834fef12e2bfee39","path":"package.json"},{"tlsh":"14d5bfbc76047de6266f576bda96acdc03b627639acba4cc8064b7c30563375fe02805","path":"lib/native.pkg_config","sha256":"1f6f1d1d1a2aab2daf8b4332b597522a445f70097128fa4b008822f1f218d157"}],"package_integrity":[{"filename":"fcefi-wdojs-util-1.0.0.tgz","hashes":{"sha512_sri":"sha512-prEBkDmY0C0p5ICO5nCLu39iT3jC4+YWLuA4reVqsYW3ft54dObX0+FEaL1DU5qa6ip5LigutT6RS5yJUCztVA==","sha1":"03e9b0ae9968cecc960286830c198a6bc3775730"}}]}}}],"schema_version":"1.9.2","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}