{"id":"MAL-2026-6318","summary":"Malicious code in ts-bn-lint-helper (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8847a06a4d25b751ec7d33732a23324a42d7b2775ce441811623500b7b60f267)\nPackage masquerades as a TypeScript lint helper but ships a credential-harvesting payload in index.js. The exported from_str() recursively walks process.cwd() and uploads every file matching id.json, config.toml, Config.toml, config.json, env, and.env to https://data-stream.space/api/v1 via axios POST (index.js:178). It additionally harvests shell history from ~/.bash_history, ~/.zsh_history, fish history, ~/.sh_history, and PowerShell PSReadLine ConsoleHost_history.txt, falling back to spawning `bash -c history` and `zsh -c 'fc -l -1000'` via execSync (index.js:101, 117, 128-152). The exfiltration URL and target file patterns are base64-encoded module-level constants decoded through a `decodeStr` helper (index.js:8-30) to evade naive string scanners. Username and local IP are prepended to each upload. The bundled test.js auto-invokes from_str() under `npm test`. Package metadata is hollow (empty description, author, keywords) and the name mimics legitimate TypeScript lint tooling. Any consumer that requires this package and calls from_str(), or runs npm test, ships their working-directory secrets and shell history to the attacker-controlled host.\n","modified":"2026-06-23T17:01:25.435948063Z","published":"2026-06-23T16:11:21Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["3.1.19"],"import_time":"2026-06-23T16:54:12.807378937Z","id":"IN-MAL-2026-007264","sha256":"8847a06a4d25b751ec7d33732a23324a42d7b2775ce441811623500b7b60f267","modified_time":"2026-06-23T16:11:21Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/ts-bn-lint-helper/v/3.1.19"}],"affected":[{"package":{"name":"ts-bn-lint-helper","ecosystem":"npm","purl":"pkg:npm/ts-bn-lint-helper"},"versions":["3.1.19"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ts-bn-lint-helper/MAL-2026-6318.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"tlsh":"94e166aa01162136d6f1e3f8eb560416f79ed2137602c74276ac4ac92f77428e1d2fec","path":"index.js","sha256":"addbcd00de83cb84cce6655375cce010012e1d9724207692c05a7b5699034e7d"},{"tlsh":"2fe0c2328e69a93708f8a6a56e681b03f1618f2f12748c0f71f7551c97e31a304a8f4d","path":"package.json","sha256":"cdea78bc905183eb899ea3a9363778b427c7cc704c2f1fe88fa983cf538a04b9"}],"package_integrity":[{"filename":"ts-bn-lint-helper-3.1.19.tgz","hashes":{"sha1":"5575cbd59199abe6385ec39e64e82c53ed1e497d","sha512_sri":"sha512-tVD1gUs5BvFLxhrm6JjlchfG2r0xESuFdGF6r4gcn7e3ZhfHafIDWnTED8YROBGyVeGC1QeV/MCurgi+n/zeog=="}}]}}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}