{"id":"MAL-2026-4581","summary":"Malicious code in idlidosa (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5c6cba2c58d95d705af7dc5bb1c630129127835fb1ef15d4ccf43ec2818bf632)\nThe package is purpose-built tooling to defeat exam-proctoring / lockdown software, with multiple installer-machine integrity harms triggered when the user runs the documented `idlidosa start` command:\n\n1. Binary masquerade as Microsoft software: `dist/cli/index.js` (~line 290) copies the bundled `electron.exe` to `msedgewebview2.exe` and uses bundled `rcedit` to overwrite its Windows version resources to claim `CompanyName=Microsoft Corporation` and `ProductName=Microsoft Edge WebView2 Runtime`. The guard process additionally sets `process.title = \"Windows Audio Device Graph Isolation\"`. An administrator auditing the host sees what appears to be a Microsoft component but is an unsigned Electron app under this package's control.\n\n2. Persistence as fake Edge updater: `installResurrector` (~line 330) registers a Windows Scheduled Task named `MicrosoftEdgeWebView2Update` that runs every 1 minute via `schtasks /create... /sc MINUTE /mo 1 /f`, re-spawning a launcher written to `%APPDATA%/Idlidosa/resurrect.js`. The task name impersonates a legitimate Microsoft Edge update job.\n\n3. Anti-detection watchdog: `cli/guard.cjs` carries self-incriminating comments stating the 1500ms restart delay is `fast enough to beat TestPad's 30s scan` and that it runs as `node.exe (which lockdown software rarely kills)`.\n\n4. Process-wide TLS validation disabled: `dist/shared/index.js` (~line 187) sets `process.env.NODE_TLS_REJECT_UNAUTHORIZED = \"0\"` at module load, disabling TLS certificate validation for every HTTPS call made by the host Node process for the lifetime of that process — not just calls made by this package. Subsequent traffic (including screenshots of the user's screen and bundled API keys) is sent over un-validated TLS and is exposed to MITM on the installer's network.\n\n5. Bundled decryptable Groq API key pool: `shared/keys.json` ships nine AES-256-GCM-encrypted Groq API keys whose decryption key is `sha256(\"pageai-pool-v2\")` (literal byte array in `shared/crypto.ts`), so any installer can decrypt them. These are the author's own keys (author self-harm), but they are used as the default channel for sending the user's screen captures over the TLS-disabled connection.\n\nThe combination of Microsoft-impersonation on disk, Microsoft-impersonation as a scheduled task, watchdog comments documenting evasion intent, and global TLS weakening constitutes deliberate harm to the integrity of any host this is installed and run on.\n","modified":"2026-06-12T20:01:52.896206796Z","published":"2026-05-20T07:38:38Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-05-20T07:38:38Z","versions":["1.0.0"],"source":"amazon-inspector","sha256":"93244f4468caec1832fe03d87c7403d7ab1dac835f12605a35667acfd3b87c39","import_time":"2026-05-26T05:50:44.033497656Z","id":"IN-MAL-2026-003495"},{"versions":["1.0.1"],"source":"amazon-inspector","sha256":"1a75611f2e499729979c4f3e6a846e27ca06346f89dc51131d467a6511d4ffa6","import_time":"2026-06-12T19:43:35.770287506Z","id":"IN-MAL-2026-005810","modified_time":"2026-06-12T19:02:25Z"},{"versions":["1.0.7"],"source":"amazon-inspector","sha256":"359ad22216d5124d653c6e6d7c72c1d004966ae82d6a4675e30cfd638ce351e9","import_time":"2026-06-12T19:43:36.056812262Z","id":"IN-MAL-2026-005813","modified_time":"2026-06-12T19:02:30Z"},{"versions":["1.0.4"],"source":"amazon-inspector","sha256":"5c6cba2c58d95d705af7dc5bb1c630129127835fb1ef15d4ccf43ec2818bf632","import_time":"2026-06-12T19:43:35.968583861Z","id":"IN-MAL-2026-005812","modified_time":"2026-06-12T19:02:28Z"},{"source":"amazon-inspector","sha256":"f88aa47e4a8bb442e853910f1f832ffc260bb47680cc63a321e2c3d5f7e41b0e","import_time":"2026-06-12T19:43:35.881018295Z","id":"IN-MAL-2026-005811","modified_time":"2026-06-12T19:02:26Z","versions":["1.0.2"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/idlidosa/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/idlidosa/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/idlidosa/v/1.0.7"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/idlidosa/v/1.0.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/idlidosa/v/1.0.2"}],"affected":[{"package":{"name":"idlidosa","ecosystem":"npm","purl":"pkg:npm/idlidosa"},"versions":["1.0.0","1.0.1","1.0.7","1.0.4","1.0.2"],"database_specific":{"indicators":{"evidence_files":[{"sha256":"a50bab4cd4aa3ca52f42b2b69c264c09ee15a465cd8b5cea38441b444fcfca1c","tlsh":"11119640e8b1ec34d99ae208c3131665461754172da7bf0f7a08458e4bdf9eea7360d8","path":"shared/keys.json"},{"sha256":"df6db9d5c5fbf2c6fee358e646ca96e5be619866b67861f2b55e907481e55c4f","tlsh":"58a20a9d74f51a3a41f320f6a81b401771a08523360deec476acaba82fae578c5f75dc","path":"dist/cli/index.js"},{"path":"desktop/resources/inject_dll.ps1","sha256":"fe75cf773fb0304449d32891082e71eead1b911658b87a610577d7d8db7d6793","tlsh":"0e4158452f56ab2134a3ad2d46cec46df20b90b213bf991879fc4330af1a09dd17a756"},{"tlsh":"a871754972f60a6c12f3c1b6223ba41b17e7c619620cc995a41ee6873f9427f01e6dfd","path":"cli/guard.cjs","sha256":"09cc2095c902d6505401f3a9d1dca25946604b3ebe5bad89a54e3efe5d7af982"}],"package_integrity":[{"filename":"idlidosa-1.0.0.tgz","hashes":{"sha512_sri":"sha512-4hTjAeZiwBsrGBYXFr/aOWTX/BFyC7e/QJB3g7B3/ZiwPAsitVFhLUZevrdyrY/mhSapFPGq3lmJcKao2oSvwg==","sha1":"e332e3ad55557b5d8b7bbc4660fb7d93c8729c5f"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/idlidosa/MAL-2026-4581.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}]}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com","inspector-research@amazon.com"],"type":"FINDER"}]}