{"id":"MAL-2026-19146","summary":"Malicious code in teahy-znrpz-util (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5d18143cb6c6ab53a6b224630d1b50f00578f4308414da4f384281a679d7861d)\nindex.js reads a numeric byte array stored under a non-standard `_bz` key inside package.json, decompresses it with zlib.inflateSync, and executes the resulting string via the Function constructor with `require` and `__dirname` bound in — all on module load. Execution is gated by an early-return when any of CI, GITHUB_ACTIONS, GITLAB_CI, TRAVIS, CIRCLECI, or SANDBOX environment variables are set, so the hidden code only runs on real developer or production hosts. Smuggling executable logic as a zlib blob under a private manifest key, decoding it, and running it through Function() at require time is an obfuscated-loader pattern; the package's self-description as a 'utility' does not match any behavior visible in its source. The payload executes with full Node privileges on the installer's machine as soon as the module is required.\n","modified":"2026-11-11T21:15:16.005902231Z","published":"2026-11-11T21:03:21Z","database_specific":{"malicious-packages-origins":[{"versions":["1.0.0"],"id":"IN-MAL-2026-022609","import_time":"2026-11-11T21:05:23.639620173Z","modified_time":"2026-11-11T21:03:21Z","sha256":"5d18143cb6c6ab53a6b224630d1b50f00578f4308414da4f384281a679d7861d","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/teahy-znrpz-util/v/1.0.0"}],"affected":[{"package":{"name":"teahy-znrpz-util","ecosystem":"npm","purl":"pkg:npm/teahy-znrpz-util"},"versions":["1.0.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/teahy-znrpz-util/MAL-2026-19146.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"filename":"teahy-znrpz-util-1.0.0.tgz","hashes":{"sha1":"717d7d22cb4149ed7afc2052fa4b204bbf752229","sha512_sri":"sha512-ICzlXwjQIPi2MfU/mb3sqGXX1WSfajsRlJFWlNv/5yxdJylwDT3S2NjSDRkM55i3FfAXcyU0ZhKiF7TtbRsLzw=="}}],"evidence_files":[{"path":"index.js","sha256":"95618430decba4e2a9241dbc787a7f5aa0a688797e2f648212c7d263f3738ba2","tlsh":"88e0e54cb3b955185891db99a42dae0264f2bad60a958461a654b1832bb0b180b5241f"}]}}}],"schema_version":"1.9.2","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}