{"id":"MAL-2026-19149","summary":"Malicious code in superlib_ex3 (npm)","details":"Malicious package. `superlib_ex3` is a multi-stage loader: on install it fetches and executes a second-stage payload from the attacker-controlled host `x.exxcube.fr` (the install hook was observed in dynamic detonation retrieving `https://x.exxcube.fr/postInstall`). No legitimate functionality; all published versions are malicious. Full indicators at the reference below.","modified":"2026-11-12T05:30:08.442829497Z","published":"2026-11-08T01:30:00Z","database_specific":{"iocs":{"domains":["x.exxcube.fr"],"urls":["https://x.exxcube.fr/postInstall"]}},"references":[{"type":"WEB","url":"https://wormsign.io/portfolio/superlib_ex3/"}],"affected":[{"package":{"name":"superlib_ex3","ecosystem":"npm","purl":"pkg:npm/superlib_ex3"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/superlib_ex3/MAL-2026-19149.json"}}],"schema_version":"1.9.2","credits":[{"name":"wormsign","contact":["https://x.com/w0rmsign"],"type":"FINDER"}]}