{"id":"MAL-2026-19144","summary":"Malicious code in strutil-helpers-core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (db7da8999828536292e11d09747504d964bf7525862de7d207d03c8809c438a0)\nThe package advertises itself as lightweight string utility helpers (trim/capitalize/truncate), but ships a 17KB Linux ELF.node addon, a 434KB Windows PE.node addon, and a 3.7MB opaque.napi_cache data blob none of which are needed for the stated purpose. index.js unconditionally loads the platform-appropriate native addon on every require() and swallows errors silently before the trivial string helpers are even defined. The native addon references the adjacent.napi_cache blob and contains code paths for file I/O, fork/setsid/execlp on Linux and CreateProcessA with a 'node \"%s\"' command template on Windows, staging decoded JavaScript at /tmp/.\u003cpid\u003e (format string /tmp/.%u, %s.nc%lu.js) and executing it under node. Before firing, the addon enumerates CI and sandbox indicators (GITHUB_ACTIONS, GITLAB_CI, TRAVIS, CIRCLECI, JENKINS_URL, BUILDKITE, CODEBUILD_BUILD_ID, APPVEYOR, SEMAPHORE, TEAMCITY_VERSION, BITBUCKET_BUILD_NUMBER, NETLIFY, VERCEL, CF_BUILD_ID, SCREWDRIVER, SANDBOX), reads /proc/1/cgroup, /proc/1/cmdline, /proc/self/status (TracerPid) and /proc/self/maps for docker/containerd/kubepod/podman markers, and on Windows checks IsDebuggerPresent, CheckRemoteDebuggerPresent and scans running processes for analysis tools (wireshark, httpdebug, Process32First). The combination of a trivial cover-story API, undeclared native binaries loaded silently on import, an opaque sibling blob decrypted to a hidden /tmp staging path and executed under node, and sandbox/CI/debugger evasion gating is a load-time dropper that runs attacker-controlled code on the installer's host as soon as the package is required.\n","modified":"2026-11-11T21:15:14.977932014Z","published":"2026-11-11T20:54:40Z","database_specific":{"malicious-packages-origins":[{"versions":["1.0.1"],"id":"IN-MAL-2026-022597","import_time":"2026-11-11T21:05:22.750952947Z","modified_time":"2026-11-11T20:54:40Z","sha256":"09bade75e501a2d7f3c846895107147e88608a1712ed9df1ae477ac6efa3e5d4","source":"amazon-inspector"},{"source":"amazon-inspector","versions":["1.0.2"],"id":"IN-MAL-2026-022603","import_time":"2026-11-11T21:05:23.204673146Z","modified_time":"2026-11-11T20:55:22Z","sha256":"db7da8999828536292e11d09747504d964bf7525862de7d207d03c8809c438a0"},{"source":"amazon-inspector","versions":["1.0.4"],"id":"IN-MAL-2026-022599","import_time":"2026-11-11T21:05:22.878609348Z","modified_time":"2026-11-11T20:54:56Z","sha256":"8ce3875e4b083194cad5109796dac0b1ed8dec78da0a302c33729c316fd23c18"},{"sha256":"a87c2de5924cb863efe7117762891a23e2e48b15915e3db6e77b96fe3192e381","source":"amazon-inspector","versions":["1.0.5"],"id":"IN-MAL-2026-022598","import_time":"2026-11-11T21:05:22.818791833Z","modified_time":"2026-11-11T20:54:48Z"},{"sha256":"afdf3cb6ed76afec475d41cd4b5cb34c42bf464c1bcfd52b21baba02290c5d2b","source":"amazon-inspector","versions":["1.0.3"],"id":"IN-MAL-2026-022600","import_time":"2026-11-11T21:05:22.947911305Z","modified_time":"2026-11-11T20:55:04Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/strutil-helpers-core/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/strutil-helpers-core/v/1.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/strutil-helpers-core/v/1.0.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/strutil-helpers-core/v/1.0.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/strutil-helpers-core/v/1.0.3"}],"affected":[{"package":{"name":"strutil-helpers-core","ecosystem":"npm","purl":"pkg:npm/strutil-helpers-core"},"versions":["1.0.1","1.0.2","1.0.4","1.0.5","1.0.3"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/strutil-helpers-core/MAL-2026-19144.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"strutil-helpers-core-1.0.1.tgz","hashes":{"sha1":"e86980174cd5f7bee025da9ea59a8e7a2fb7ba02","sha512_sri":"sha512-jVjUAYuydNbI6ffWVzcHvXRUeDvIwrWaC0kgxLlYGysBN2mIGxc262JfrEUeP9TnN/a+v/KjSNtWPaFeC/CuiA=="}}],"evidence_files":[{"path":"index.js","sha256":"302c9c66aa41e64d15ee3e0d5979392fe677059b7d3c0cf4610cee9b27b15c43","tlsh":"5ee020ccb692701d46f41a752b67528191d6c7d05849813194d644a8382449c2ee6c9f"},{"path":"native.napi.node","sha256":"c7c76344ce570cf84aaa8c2ea7e5f1ec6f41fbfcbc8b11200ed41e96a22ba2b1","tlsh":"6272954bd3a0dd3ec4d86231598b527252a2d070ef30172f0f54a6fb2d933586a7ae52"},{"path":"package.json","sha256":"111eb2e89eb19abacef35a5080197b6f56a43d06245ffb00ab3d03e50352599d","tlsh":"b4d02e3496016c2305dc8aa16a924a0401718e0b0244b81c3beb001d87bdaaf20fbaac"}]}}}],"schema_version":"1.9.2","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}