{"id":"MAL-2026-6401","summary":"Malicious code in zenith-utils (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c29676376a28531b186e09fbf7e2d3a0697943ece764e0604ebbdd4b734ae094)\nPackage name is zenith-utils but the tarball is a verbatim copy of the nodemailer source tree (lib/nodemailer.js as main, lib/smtp-transport, lib/ses-transport, lib/dkim, lib/mail-composer, etc.; package.json author set to nodemailer's real maintainer 'Andris Reinman'). package.json declares `postinstall: node lib/utils/index.js`, which uses spawn with `detached: true`, `stdio: ['ignore','ignore','ignore']`, and `child.unref()` to launch lib/utils/smtp-connection/index.js as a hidden background process that survives the npm install command. That process forks lib/utils/smtp-connection/worker.js, which polls `https://jsonkeeper.com/b/WDH3V` in an infinite loop and executes the returned `cookie` field via `new Function('require', r.data.cookie)(require)`. jsonkeeper.com is an anonymous, mutable paste host — the author can change the served payload at any time, granting arbitrary Node-privileged code execution on every machine that has installed the package. The detached/unref'd spawn is deliberately designed to hide the activity from npm's lifecycle logs while the eval loop runs persistently in the background.\n","modified":"2026-06-24T18:46:29.614980702Z","published":"2026-06-24T18:05:07Z","database_specific":{"malicious-packages-origins":[{"versions":["12.0.14"],"id":"IN-MAL-2026-007442","import_time":"2026-06-24T18:41:01.057182649Z","modified_time":"2026-06-24T18:05:12Z","sha256":"93912585a6536fdb12c8341a2a896f3c51943f70f74a0fdd45b0c4c76030ab2e","source":"amazon-inspector"},{"source":"amazon-inspector","versions":["12.0.15"],"id":"IN-MAL-2026-007441","import_time":"2026-06-24T18:41:01.01892Z","modified_time":"2026-06-24T18:05:07Z","sha256":"c29676376a28531b186e09fbf7e2d3a0697943ece764e0604ebbdd4b734ae094"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/zenith-utils/v/12.0.14"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/zenith-utils/v/12.0.15"}],"affected":[{"package":{"name":"zenith-utils","ecosystem":"npm","purl":"pkg:npm/zenith-utils"},"versions":["12.0.14","12.0.15"],"database_specific":{"indicators":{"package_integrity":[{"hashes":{"sha1":"dabb64ce9ff8824c76e3bf497652e379c8fe4a0d","sha512_sri":"sha512-lF3G1vx+NnYo7cLWtRJUUL+S9gqDPd0knoOTk8/Al7ifnnME1H2QuCLR4dR18o6nxVZ8GuT4Wkqg8mGU1UWQLw=="},"filename":"zenith-utils-12.0.14.tgz"}],"evidence_files":[{"path":"lib/utils/smtp-connection/index.js","sha256":"f94135cbe8ec654951d9482c17411d4161390492c181be55c5add2e0f673a606","tlsh":"e9e0686327e4602e213615f2e79e20227007c1636a9afcd9b3c88bb256d2ed11d12ef4"},{"tlsh":"7cf0a6802cb8fb900345b0e7c0bbeb07a198a068312287a48a8f9d5a45868488a130dd","path":"lib/utils/smtp-connection/parse.js","sha256":"4aac106a4f36aba6433c7ded453d724307ee55616e240883cd46204549cf24b1"}]},"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/zenith-utils/MAL-2026-6401.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}