{"id":"MAL-2026-5644","summary":"Malicious code in self-certificate (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ab587fcd5a0b45e17454fc742007b8b597a0aec49b443d8a5a087ba910ea4a40)\nThe package presents itself as a self-signed certificate generator, but its public generateCertificates() API path loads sample/cert.pem, strips the BEGIN/END CERTIFICATE armor, base64-decodes the body, and eval()s the result. The fake PEM is not a DER certificate — it decodes to a JavaScript IIFE that fetches https://aptupdate.org/settings/privacy.php (destination itself base64-encoded for a second layer of concealment) and pipes the response into a spawned python3/python interpreter (`spawn('python3'|'python', ['-'], {stdio:['pipe','ignore','ignore'], detached:true, windowsHide:true})`), writes the fetched bytes to stdin, and unref()s the child so it outlives the caller. The combination of cover-story file extension, double-base64-wrapped C2 URL, detached/hidden/stdio-ignored Python execution, and eval of a payload disguised as a certificate is a deliberately concealed remote-code execution backdoor against any consumer of the advertised API.\n","modified":"2026-06-26T19:01:39.028844263Z","published":"2026-06-11T13:02:34Z","database_specific":{"malicious-packages-origins":[{"sha256":"4a2141f4facbd3abc437287c86971f1b3bb6795fad75990624f735b72139167d","import_time":"2026-06-11T13:27:20.534148804Z","id":"IN-MAL-2026-005730","modified_time":"2026-06-11T13:02:34Z","versions":["1.0.0"],"source":"amazon-inspector"},{"id":"IN-MAL-2026-007653","modified_time":"2026-06-26T18:18:17Z","versions":["1.1.0"],"source":"amazon-inspector","sha256":"ab587fcd5a0b45e17454fc742007b8b597a0aec49b443d8a5a087ba910ea4a40","import_time":"2026-06-26T18:42:50.035074564Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/self-certificate/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/self-certificate/v/1.1.0"}],"affected":[{"package":{"name":"self-certificate","ecosystem":"npm","purl":"pkg:npm/self-certificate"},"versions":["1.0.0","1.1.0"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"filename":"self-certificate-1.0.0.tgz","hashes":{"sha1":"2034d348c5e4ead18b83a05ddad6282dee19e097","sha512_sri":"sha512-/fVL29/HyMgsxmH6nplNP7M52rpNhRXLmmMlSS2ulwV9yD7nz2trODTNCxzOBDLuzM18UxiiNmSEIGRGusTtfQ=="}}],"evidence_files":[{"path":"index.js","sha256":"8df2981a688b04f04d130cf10c3715dec00d59b81953636d891aa2a3318e3982","tlsh":"f541038579e2b96204d79674454b8050b42ce103b70aecab36de86d16f16e6cd27efcc"},{"path":"sample/cert.pem","sha256":"67642cb874a1de4a653491c56f4c3324fc95364da43724d07399b8a453908a18","tlsh":"4011d0029d972d990764f9ae14fd93c355af13c3b9e242f9489ed1a8297c09a18d8038"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/self-certificate/MAL-2026-5644.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}