{"id":"MAL-2026-5165","summary":"Malicious code in @emcd-vue/loans (npm)","details":"Part of a coordinated multi-package supply-chain attack impersonating EMCD (emcd.io), a legitimate Russian cryptocurrency exchange and mining pool. The attacker registered the `@emcd-vue` npm scope to distribute multiple malicious packages posing as internal tooling. This package was published 90 seconds after sibling package `@emcd-vue/auth` on 2026-06-01 by the same anonymous account (`emcd-vue@proton.me`).\n\nConfirmed to use identical infrastructure and dropper logic as `@emcd-vue/auth`: downloads a platform-specific second-stage payload from `https://oob.moika.tech/payload/{platform}` using `X-Secret: l95HdDaz3kQx1Zsg3WxH6HvKANf51RY1`, writes it to `~/.emcd-vue_init.js` (dot-prefixed hidden file), and executes it as a detached, unref'd process that persists after npm exits. Beacons installation metadata to `https://oob.moika.tech/report` on completion.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (febfe36bf4efb63283bdcac20e625459b8f63358c2e32921a747f29bb2d65917)\nThe package ships a heavily obfuscated postinstall script (scripts/postinstall.js) that executes automatically on `npm install`. The file uses hex-mangled identifier names (_0x2556a0, _0x3929dc, _0x2f9082, etc.) consistent with string-array obfuscators commonly used to hide network exfiltration, credential harvesting, or remote payload execution. Obfuscation in a lifecycle hook is not a legitimate engineering practice — install-time scripts in legitimate packages are readable shell or plain JS. The package name (@emcd-vue/loans) advertises a Vue.js loans component, which has no plausible reason to require obfuscated postinstall logic. Installing this package will run the obfuscated code automatically with the privileges of the developer or build system performing `npm install`.\n","modified":"2026-06-12T20:01:52.258663445Z","published":"2026-06-01T07:05:43Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-06-12T19:43:38.061479074Z","source":"amazon-inspector","id":"IN-MAL-2026-005832","sha256":"5533f10b35ebd7228376d5d97b22009e7d836f198069a2ed894f0cc709fb2d44","versions":["7.1.8"],"modified_time":"2026-06-12T19:02:54Z"},{"import_time":"2026-06-12T19:43:37.973434802Z","source":"amazon-inspector","id":"IN-MAL-2026-005831","versions":["7.1.8"],"sha256":"febfe36bf4efb63283bdcac20e625459b8f63358c2e32921a747f29bb2d65917","modified_time":"2026-06-12T19:02:53Z"}]},"references":[{"type":"REPORT","url":"https://safedep.io/oob-moika-tech-dependency-confusion-campaign/"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@emcd-vue/loans/v/7.1.8"}],"affected":[{"package":{"name":"@emcd-vue/loans","ecosystem":"npm","purl":"pkg:npm/%40emcd-vue%2Floans"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["7.1.8"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@emcd-vue/loans/MAL-2026-5165.json","indicators":{"evidence_files":[{"path":"scripts/postinstall.js","sha256":"d6642a67d569aa9008b3f17ecf0ca4644d6f56038f73f70027df1b394d13c45e","tlsh":"19526644eb8061427b079b7b372bb0d4f4194d9176d6098be2087b7cfc46629e5fae34"}],"domains":["oob.moika.tech.ec2.internal","oob.moika.tech"],"package_integrity":[{"hashes":{"sha1":"5e87e577e1a66e00c162dbf51ca2fd25eb83a7bc","sha512_sri":"sha512-1peMtksqIA/s5NFn+Gftk28ml3JovorSULyPMnfqtc7XGaJZf10ly0BjtQDWLa3gv+n7+F5mr2KmZ5Qgc5YGsQ=="},"filename":"loans-7.1.8.tgz"}]},"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}]}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"SafeDep","contact":["https://safedep.io"],"type":"FINDER"}]}