{"id":"MAL-2026-4563","summary":"Malicious code in finkrouter (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (75cee0798d304ff9f0532df845511df6560314b8808664c15b3c3aa18f1953b5)\nThe package's CLI (shipped as cli.obf.js, the javascript-obfuscator output with RC4 string-array encoding and control-flow flattening per package.json prepublishOnly) prompts the user for an Auth Token and then writes ~/.claude/settings.json, setting ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN to a hardcoded API_BASE_URL whose literal is RC4-encoded so installers cannot audit the destination. Once configured, every Claude Code request — including source code, prompts, secrets embedded in prompts, and the Anthropic auth token — is silently relayed through the author's proxy instead of Anthropic. A provisionSentinel() routine writes ~/.fink/sentinel.js and appends `(cd ~ && node ~/.fink/sentinel.js &) # Fink Sentinel` to ~/.bashrc, ~/.zshrc, ~/.profile (or registers equivalents via PowerShell setx on Windows), giving the daemon persistence across reboots independent of the npm package. installECC() performs `git clone \u003cRC4-encoded URL\u003e` into ~/.fink, then on subsequent invocations runs `git fetch --all && git reset --hard origin/main` followed by `npm install` in the cloned tree — a mutable-branch, unpinned remote-code channel allowing the author to ship arbitrary new code into the installer's home directory on every CLI run. A purgeCaveman() routine additionally tampers with a competing tool's configuration by deleting hooks, agents, and statusLine entries referencing 'caveman' from ~/.claude/settings.json and stripping `## Caveman` sections from CLAUDE.md files in $HOME and CWD. Together these constitute credential capture, silent relay of sensitive AI traffic, persistent backdoor, and an unpinned remote-code execution channel.\n","modified":"2026-06-12T20:01:51.202239130Z","published":"2026-05-22T10:25:25Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-05-22T10:25:25Z","versions":["0.1.0"],"source":"amazon-inspector","sha256":"ff852ad2ff69ee287dd37d79ea134314ffca73772068117b819495250ff401f3","import_time":"2026-05-26T05:52:06.387990665Z","id":"IN-MAL-2026-004187"},{"sha256":"75cee0798d304ff9f0532df845511df6560314b8808664c15b3c3aa18f1953b5","import_time":"2026-06-12T19:44:05.809662313Z","id":"IN-MAL-2026-006080","modified_time":"2026-06-12T19:08:21Z","versions":["1.1.1"],"source":"amazon-inspector"},{"sha256":"9ff19d6dc7e3eaa2ae39e6945fc76f54115dd7d885dae5b61b5b0b5c83ea4f6b","import_time":"2026-06-12T19:44:05.936368009Z","id":"IN-MAL-2026-006081","modified_time":"2026-06-12T19:08:22Z","versions":["1.1.2"],"source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/finkrouter/v/0.1.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/finkrouter/v/1.1.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/finkrouter/v/1.1.2"}],"affected":[{"package":{"name":"finkrouter","ecosystem":"npm","purl":"pkg:npm/finkrouter"},"versions":["0.1.0","1.1.1","1.1.2"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/finkrouter/MAL-2026-4563.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"hashes":{"sha1":"65450f848fc344aafb13a49d86b15ef6ce2e828b","sha512_sri":"sha512-Lt3JvcEjtTBh2uj54ngjZbGju1IafwOvO7Gqwu2tesgmJHfWvjScDiZIwoZys3SUt6wrW1KyTvieVFsGrJm7vA=="},"filename":"finkrouter-0.1.0.tgz"}],"evidence_files":[{"tlsh":"bc832ac4d281b4daa3871ef73a27a0e0f947448570888759e9c8bdbc7d64637e6f4a31","path":"cli.obf.js","sha256":"2ae04ffc731450dacb2f0c239635b7a2dc0639b6c5ba2a99e06080e296f0f866"}]}}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com","inspector-research@amazon.com"],"type":"FINDER"}]}