{"id":"MAL-2026-5912","summary":"Malicious code in js-digest (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (52847ff329757e0777e62c1c060455abc4ddd6f002c295a7f38d0e0489daf76f)\nPackage impersonates crypto-js: name is `js-digest` but `package.json` carries crypto-js's exact description (\"JavaScript library of cryptography standards.\"), homepage `http://github.com/brix/js-digest` (brix is the crypto-js org), and author \"Evan Vosberg\" (the crypto-js maintainer). `package.json` declares `\"preinstall\": \"./lib/install-deps.mjs\"`, but `lib/install-deps.mjs` is not JavaScript — it is a 3.2 MB Linux x86_64 ELF binary (magic `7F 45 4C 46`, sha256 `7883bda1ff15425f2dbe622c45a3ae105ddfa6175009bbf0b0cad9bf5c79b316`). On `npm install`, npm's preinstall hook executes this native binary with the installer's privileges before any code is reviewed. Strings extracted from the binary show a multi-platform credential harvester: HTTP requests scraping GitHub (`GET /user`, `/user/repos` with `Authorization: Bearer...`), Slack (`POST /api/auth.test` with `Cookie: d=`), Discord, Microsoft Teams (`/api/mt/*`), and HashiCorp Vault (`X-Vault-Token`, `/v1/...`); reads of `/.vault-token`, `/.vault/token`, `gpg --batch --no-tty --list-keys`, and `/proc/\u003cpid\u003e/{mem,cmdline,environ}`; and multipart POST uploads to remote endpoints. The binary also embeds systemd unit templates (`[Unit]/[Service]/ExecStart=.../Restart=always`) for both system (`/etc/systemd/system/`) and user (`~/.config/systemd/user/`) scopes for persistence, plus libbpf rootkit primitives (`bpf_object__open_mem`, `bpf_map__pin`, `bpf_program__attach`, maps `hidden_pids`/`hidden_inodes`/`hidden_names`, `/sys/fs/bpf/`) for kernel-level concealment from `ps`/`ls`/`lsof`. Installing this package compromises the host with a persistent, hidden credential stealer.\n","modified":"2026-06-16T20:01:51.433347206Z","published":"2026-06-16T19:45:33Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-06-16T19:46:15.670149211Z","modified_time":"2026-06-16T19:45:33Z","sha256":"52847ff329757e0777e62c1c060455abc4ddd6f002c295a7f38d0e0489daf76f","source":"amazon-inspector","versions":["4.2.2"],"id":"IN-MAL-2026-006826"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/js-digest/v/4.2.2"}],"affected":[{"package":{"name":"js-digest","ecosystem":"npm","purl":"pkg:npm/js-digest"},"versions":["4.2.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/install-deps.mjs","sha256":"7883bda1ff15425f2dbe622c45a3ae105ddfa6175009bbf0b0cad9bf5c79b316","tlsh":"28e57f03f6e244e9d8a9cd70835fe237ea24b8855122b12b6bd45b413f26f309f5e791"},{"path":"package.json","sha256":"7627d4750cfc64e08b9f1057a1d68cd9fc6e35d07fcf3aa7e456a326413a30c1","tlsh":"5c014570dc20dc761ad865929c7a88827a9008678c04bc0df3d7080c9f8d5af2abe34e"}],"package_integrity":[{"filename":"js-digest-4.2.2.tgz","hashes":{"sha512_sri":"sha512-7ggazjzzGjR/ZelAVvl9Bry0F0DMDHldZ97eF3IPlLBuS6ZTNO3tjm8UL/d5fXZX5TzMG/dZF2YCbrPrLgffXA==","sha1":"25dc63fac83bcc50520f9584e99fcea38ce538a2"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/js-digest/MAL-2026-5912.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}