{"id":"MAL-2026-6140","summary":"Malicious code in @httpactions/strict-uri-encode (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b90fd30f5d52b139ea7be77aa1782a5339f39355ec7ad532af2fa7a49616ff88)\n@httpactions/strict-uri-encode impersonates the popular unscoped npm package 'strict-uri-encode' (~30M weekly downloads) by republishing the same name under a lookalike scope. The package ships no URI-encoding functionality; index.js is a heavily obfuscated dropper (obfuscator.io-style 110-entry rotating string array, base64-decoded module names for 'https', 'child_process', 'writeFileSync', 'exec', 'spawn', 'hostname', 'username') that executes immediately on require() and again every ~10 minutes via setInterval. The dropper assembles a hardcoded IP-based URL from base64 fragments (e.g. 'MC44Ni4x' → '0.86.117.x'), HTTPS-GETs a remote payload, writes it to disk via fs.writeFileSync, and executes it via child_process.exec/spawn — yielding arbitrary remote code execution on any machine that requires the module. In parallel, bt() POSTs {ts, type, hid, ss, cc} containing os.hostname() and os.userInfo().username to the same hardcoded IP, exfiltrating installer host identity unconditionally on import and on the 10-minute timer. Combination of typosquatted name, zero legitimate functionality, heavy obfuscation, hardcoded IP C2, host-identity exfiltration, and require-time fetch-and-execute is an unambiguous supply-chain attack.\n","modified":"2026-06-18T19:31:47.072318509Z","published":"2026-06-18T18:39:24Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-007015","import_time":"2026-06-18T19:20:02.040734339Z","modified_time":"2026-06-18T18:39:24Z","sha256":"b90fd30f5d52b139ea7be77aa1782a5339f39355ec7ad532af2fa7a49616ff88","source":"amazon-inspector","versions":["1.0.1"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@httpactions/strict-uri-encode/v/1.0.1"}],"affected":[{"package":{"name":"@httpactions/strict-uri-encode","ecosystem":"npm","purl":"pkg:npm/%40httpactions%2Fstrict-uri-encode"},"versions":["1.0.1"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"hashes":{"sha512_sri":"sha512-w51inI48YEcRjhDF6776eIR8RbLSyyg9YVuOYnAA/OPoam+COg3PpZQesi/etByT/q5TGJdgUfBLlBWcX4zKBA==","sha1":"cf0ffa0e74c1c1dd2bd4909c566eef0d2ff5e163"},"filename":"strict-uri-encode-1.0.1.tgz"}],"evidence_files":[{"path":"index.js","sha256":"94397cb3d725971892a20bbbcc2509009d4e15f96eab2e99bca04d6b0b05127b","tlsh":"f31267897fe2f052d721647b6837625a632f4c8473084988f23615d0be1977af1b76ec"},{"sha256":"c0552adecca66ed6149b24cbed448fe5078c8df702c8d7dba4b23bd2278d5db3","tlsh":"3bd0a7383961953305c606120c7aa45ab770df2f1044380987cb183c81df6b35cfa32d","path":"package.json"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@httpactions/strict-uri-encode/MAL-2026-6140.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}