{"id":"MAL-2026-6723","summary":"Malicious code in electron-orbit (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7faf51a6c9d6ed9fce8cf9de9ea8afee0e9c3dc1fb254e8cd0c3c2a8ca61323f)\nOn `require('electron-orbit')`, the module unconditionally fires an auto-prefetch pipeline in Node contexts (when no `document` is present) that opens a raw `node:net` socket to `electronorbit.blob.core.windows.net:443` and speaks a hand-written TLS 1.3 stack (custom ClientHello, HKDF key schedule, AES-128-GCM in aetherls.ts) rather than using `https`, bypassing standard TLS interception and static inspection. Every network-related string — the Azure hostname components, `node:net`, `connect`, ALPN `http/1.1`, HTTP request line, marker filename, and `process.env` enumeration keys — is XOR-obfuscated through a helper `__s(key, arr)`. The postinstall script `install.js` writes an install marker to `os.tmpdir()/electron_orbit_install_marker.txt` containing `process.env` entries whose keys match `path` (PATH-family variables) plus `process.cwd()`, and separately stages `os.hostname()`, `os.userInfo().username`, `process.version`, platform and arch into a decoy file under `bin/formatters/` prefixed with a fake native-binary magic byte. On `require`, index.ts reads the tmpdir marker, XORs it with the string `electron-orbit`, hex-encodes it, and appends the result as a query-string suffix to the Azure blob URL, so the storage account's HTTP request logs capture the installer's PATH-family environment and working directory. Activation is gated: the destination host is only populated when the SHA-256 of `process.env.BuildType` is a substring of a hardcoded 64-hex constant (`0ceaa396…8295`); otherwise the source is set to `%TEMP%` and the request fails to resolve, keeping the payload dormant on non-targeted installers and firing only when a specific env var is set (e.g., in a chosen CI environment). The advertised purpose (Electron-style runtime discovery) has no relationship to icon fetching or SVG rendering; the icon surface is a pretext — `getRegisteredIcon` returns a hardcoded empty `\u003csvg\u003e` regardless of the network response.\n","modified":"2026-07-01T22:16:51.538375235Z","published":"2026-07-01T21:15:10Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-07-01T22:03:00.008165656Z","versions":["1.0.21"],"sha256":"10848278600fe8696063359d8f022d4d0732ac5825506d800707afe08110320e","source":"amazon-inspector","modified_time":"2026-07-01T21:17:12Z","id":"IN-MAL-2026-007924"},{"import_time":"2026-07-01T22:03:00.537333616Z","versions":["1.0.11"],"sha256":"b925cd8754d91ca746f88287af2d6331578be16f842665ba2dd746665d20089a","source":"amazon-inspector","modified_time":"2026-07-01T21:18:29Z","id":"IN-MAL-2026-007932"},{"import_time":"2026-07-01T22:03:00.466853262Z","versions":["1.0.14"],"sha256":"47e8d77c0b581ef00c04e40584b9242f1e948d0330e76f877783a975d863d244","source":"amazon-inspector","modified_time":"2026-07-01T21:18:22Z","id":"IN-MAL-2026-007931"},{"import_time":"2026-07-01T22:03:00.819999477Z","versions":["1.0.4"],"sha256":"92153bc4e68cffd4c1d0e5b11ca3bc772f77b25cfbe012b5f71614de1288b990","source":"amazon-inspector","modified_time":"2026-07-01T21:19:02Z","id":"IN-MAL-2026-007936"},{"import_time":"2026-07-01T22:02:59.898992079Z","versions":["1.0.22"],"sha256":"952200b7df4332004cc5fefbaa4bcb7d8f1ab097c295e79afae66fe19d23aae6","source":"amazon-inspector","modified_time":"2026-07-01T21:16:54Z","id":"IN-MAL-2026-007922"},{"import_time":"2026-07-01T22:02:59.969074194Z","versions":["1.0.23"],"sha256":"e88ccedca508e4a1138bf6749aeb112e97fdea672ffd4d8553d99da05dbc84a5","source":"amazon-inspector","modified_time":"2026-07-01T21:17:04Z","id":"IN-MAL-2026-007923"},{"import_time":"2026-07-01T22:03:00.311405766Z","versions":["1.0.13"],"sha256":"8de289d6073561060a409931399a18484fd826ada63e5fae4f2b30c618172ac4","source":"amazon-inspector","modified_time":"2026-07-01T21:18:03Z","id":"IN-MAL-2026-007929"},{"import_time":"2026-07-01T22:03:00.17503458Z","versions":["1.0.20"],"sha256":"c29ff208e55231dcf792181b153ecbf8d546a0f285f415ccae0358f0d0e757d1","source":"amazon-inspector","modified_time":"2026-07-01T21:17:32Z","id":"IN-MAL-2026-007926"},{"import_time":"2026-07-01T22:02:59.695838704Z","versions":["1.0.26"],"sha256":"816096531ac2b919acfef3d9512968cf694c98e14cb2ee1ce1430877ce39170a","source":"amazon-inspector","modified_time":"2026-07-01T21:16:14Z","id":"IN-MAL-2026-007918"},{"import_time":"2026-07-01T22:03:00.584279878Z","versions":["1.0.10"],"sha256":"19c68f98c57515e576aef9cc6bd4d2801f813b382d3ea55091c423663d8106cf","source":"amazon-inspector","modified_time":"2026-07-01T21:18:38Z","id":"IN-MAL-2026-007933"},{"import_time":"2026-07-01T22:03:00.253967834Z","versions":["1.0.15"],"sha256":"36ceb992564dfb37d1d5d28dc2b31f99361fc1392c85592bfce2b97eef195c90","source":"amazon-inspector","modified_time":"2026-07-01T21:17:53Z","id":"IN-MAL-2026-007928"},{"import_time":"2026-07-01T22:03:00.427547597Z","versions":["1.0.12"],"sha256":"54c50d1b1671037faea6193cf6d7994bfd7c4fba7640d2935546712d7ebed8e7","source":"amazon-inspector","modified_time":"2026-07-01T21:18:12Z","id":"IN-MAL-2026-007930"},{"modified_time":"2026-07-01T21:19:27Z","versions":["1.0.3"],"sha256":"77275717c30e5629daba99b0a9ae1dd5a30b7b3fb013fe66a66a8213ab32ad8e","source":"amazon-inspector","import_time":"2026-07-01T22:03:00.97514881Z","id":"IN-MAL-2026-007939"},{"import_time":"2026-07-01T22:02:59.522446423Z","versions":["1.0.33"],"sha256":"78d034e73e1a01e3c47c1b0ade337cd56fd392e0be1398b13fbdf051d6166220","source":"amazon-inspector","modified_time":"2026-07-01T21:15:45Z","id":"IN-MAL-2026-007914"},{"import_time":"2026-07-01T22:02:59.407241934Z","versions":["1.0.34"],"sha256":"bae81fe7c1395441c366ea9e03e33844d0f8ce1cd5d05c40873cd4fb858bb64d","source":"amazon-inspector","modified_time":"2026-07-01T21:15:19Z","id":"IN-MAL-2026-007911"},{"modified_time":"2026-07-01T21:15:26Z","versions":["1.0.36"],"sha256":"6245487ae50f09a690451f235b8c9855d2f666f2b0a25e93871cf7a1251b5d69","source":"amazon-inspector","import_time":"2026-07-01T22:02:59.444375253Z","id":"IN-MAL-2026-007912"},{"import_time":"2026-07-01T22:02:59.770673779Z","versions":["1.0.28"],"sha256":"7faf51a6c9d6ed9fce8cf9de9ea8afee0e9c3dc1fb254e8cd0c3c2a8ca61323f","source":"amazon-inspector","modified_time":"2026-07-01T21:16:21Z","id":"IN-MAL-2026-007919"},{"import_time":"2026-07-01T22:02:59.656385696Z","versions":["1.0.27"],"sha256":"74a4c2467a3c20b1532b6935cc3ae3c984c06c696a4a430c886f155a562ce3f4","source":"amazon-inspector","modified_time":"2026-07-01T21:16:07Z","id":"IN-MAL-2026-007917"},{"import_time":"2026-07-01T22:02:59.615635898Z","versions":["1.0.29"],"sha256":"8607b322e5ebd914296b192b0877ba45f5e9750dc69c924f7d939d2b8b378c5f","source":"amazon-inspector","modified_time":"2026-07-01T21:15:59Z","id":"IN-MAL-2026-007916"},{"modified_time":"2026-07-01T21:15:52Z","versions":["1.0.30"],"sha256":"8c298b3f9b2691ab1ebb958398e1736aa636d9ee4e5d54acb0b57a5e1f93167c","source":"amazon-inspector","import_time":"2026-07-01T22:02:59.555589088Z","id":"IN-MAL-2026-007915"},{"import_time":"2026-07-01T22:02:59.802868311Z","versions":["1.0.25"],"sha256":"9c9d089e560d6af7ee6fbfc04edfc6f073ef8fec7f555102011e47f2f33a3df7","source":"amazon-inspector","modified_time":"2026-07-01T21:16:33Z","id":"IN-MAL-2026-007920"},{"modified_time":"2026-07-01T21:19:09Z","versions":["1.0.7"],"sha256":"d9634442d2460040970659611fb37887044b6a6f10a63c17f73161b1b21a3ce0","source":"amazon-inspector","import_time":"2026-07-01T22:03:00.877084463Z","id":"IN-MAL-2026-007937"},{"import_time":"2026-07-01T22:03:00.214957014Z","versions":["1.0.16"],"sha256":"150616fc5c43dab7fcc26b65b7817ccc01229778cc7bcf143025d16b4d3cc3da","source":"amazon-inspector","modified_time":"2026-07-01T21:17:42Z","id":"IN-MAL-2026-007927"},{"import_time":"2026-07-01T22:03:00.915016621Z","versions":["1.0.5"],"sha256":"1d12525ca427cbe9367a0caefb4b1020cc0593fa2b428b691c0e635a48d2757c","source":"amazon-inspector","modified_time":"2026-07-01T21:19:17Z","id":"IN-MAL-2026-007938"},{"import_time":"2026-07-01T22:03:00.682327954Z","versions":["1.0.9"],"sha256":"70733642ade646f823a77e8ae1616337f76e9340fc84a3a5da7c2365a58f6d00","source":"amazon-inspector","modified_time":"2026-07-01T21:18:48Z","id":"IN-MAL-2026-007934"},{"import_time":"2026-07-01T22:03:00.733638694Z","versions":["1.0.8"],"sha256":"c37583c0ed58e2b399630b0a314361d54f7b4927faeadcba99122205c37d78fa","source":"amazon-inspector","modified_time":"2026-07-01T21:18:54Z","id":"IN-MAL-2026-007935"},{"import_time":"2026-07-01T22:03:01.087889736Z","versions":["1.0.6"],"sha256":"1402a4a73f05f68a55951e93a03c1758d6406fb97a056d84802c21244e3d5393","source":"amazon-inspector","modified_time":"2026-07-01T21:19:44Z","id":"IN-MAL-2026-007941"},{"import_time":"2026-07-01T22:02:59.843512238Z","versions":["1.0.24"],"sha256":"b81cc5f0d2ed6deaed9b0956f47d024f9c42b291090c71d5abec8e34d0c2ab62","source":"amazon-inspector","modified_time":"2026-07-01T21:16:46Z","id":"IN-MAL-2026-007921"},{"import_time":"2026-07-01T22:02:59.476587914Z","versions":["1.0.32"],"sha256":"c3b84ec0bc193e98c0c57657693f84fc2ccbe0ef8ed7a66b919d9ec486d5e515","source":"amazon-inspector","modified_time":"2026-07-01T21:15:36Z","id":"IN-MAL-2026-007913"},{"import_time":"2026-07-01T22:03:00.042382523Z","versions":["1.0.18"],"sha256":"b84bfc662b2e38c56da1343ec68aa18255a7a43be7a97ef9227de541e0a9a5a2","source":"amazon-inspector","modified_time":"2026-07-01T21:17:25Z","id":"IN-MAL-2026-007925"},{"import_time":"2026-07-01T22:02:59.371792985Z","versions":["1.0.31"],"sha256":"c7750cd6d1bd46851da24a4090675984c9f66dd4b8d3634e9a58ce6896a2c11c","source":"amazon-inspector","modified_time":"2026-07-01T21:15:10Z","id":"IN-MAL-2026-007910"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/electron-orbit/v/1.0.21"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/electron-orbit/v/1.0.11"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/electron-orbit/v/1.0.14"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/electron-orbit/v/1.0.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/electron-orbit/v/1.0.22"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/electron-orbit/v/1.0.23"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/electron-orbit/v/1.0.13"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/electron-orbit/v/1.0.20"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/electron-orbit/v/1.0.26"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/electron-orbit/v/1.0.10"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/electron-orbit/v/1.0.15"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/electron-orbit/v/1.0.12"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/electron-orbit/v/1.0.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/electron-orbit/v/1.0.33"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/electron-orbit/v/1.0.34"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/electron-orbit/v/1.0.36"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/electron-orbit/v/1.0.28"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/electron-orbit/v/1.0.27"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/electron-orbit/v/1.0.29"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/electron-orbit/v/1.0.30"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/electron-orbit/v/1.0.25"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/electron-orbit/v/1.0.7"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/electron-orbit/v/1.0.16"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/electron-orbit/v/1.0.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/electron-orbit/v/1.0.9"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/electron-orbit/v/1.0.8"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/electron-orbit/v/1.0.6"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/electron-orbit/v/1.0.24"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/electron-orbit/v/1.0.32"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/electron-orbit/v/1.0.18"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/electron-orbit/v/1.0.31"}],"affected":[{"package":{"name":"electron-orbit","ecosystem":"npm","purl":"pkg:npm/electron-orbit"},"versions":["1.0.21","1.0.11","1.0.14","1.0.4","1.0.22","1.0.23","1.0.13","1.0.20","1.0.26","1.0.10","1.0.15","1.0.12","1.0.3","1.0.33","1.0.34","1.0.36","1.0.28","1.0.27","1.0.29","1.0.30","1.0.25","1.0.7","1.0.16","1.0.5","1.0.9","1.0.8","1.0.6","1.0.24","1.0.32","1.0.18","1.0.31"],"database_specific":{"indicators":{"evidence_files":[{"tlsh":"3ef1324286aa4670573213aa8d578d09f7369a170702525e7efd83885fb6c2094e3ffe","path":"install.js","sha256":"74371bc877a042a9e43f531ec89a9ceb11fb1e002fa19f7c5190799ec713a09c"},{"tlsh":"1d32a9907f50f0b5e3ad269594bba94bb3f459d0d80e0408e16998cf3a70cd4c677fa9","path":"dist/index.js","sha256":"5442d0af9d1b2fda5b5f6ddecc9450d4b1aeeca0e015e1186ad3440b7ff72124"},{"tlsh":"84215637e4a4dd535af89b94a8790f89f2310b9f41145c0b74b2012c0bb646b01aebaf","path":"package.json","sha256":"c4298a843c8b4ba6cc0bda50808a8e083754b57c92e3c8244573d6f96c5d4690"}],"package_integrity":[{"hashes":{"sha512_sri":"sha512-WXA8oVnmBi3HZ5YQ+XHZDGBKK+CGruS364F6OhdRptVx6YHRYxFBvJc/9BwOniDn+PibLVMFlslORnO3EdKPZQ==","sha1":"aca7b7cf1a21403da0981661ff9301a98ecf3f7d"},"filename":"electron-orbit-1.0.36.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/electron-orbit/MAL-2026-6723.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","cweId":"CWE-506","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","cweId":"CWE-506","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","cweId":"CWE-506","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","cweId":"CWE-506","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","cweId":"CWE-506","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","cweId":"CWE-506","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","cweId":"CWE-506","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","cweId":"CWE-506","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","cweId":"CWE-506","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","cweId":"CWE-506","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","cweId":"CWE-506","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","cweId":"CWE-506","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","cweId":"CWE-506","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","cweId":"CWE-506","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","cweId":"CWE-506","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","cweId":"CWE-506","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","cweId":"CWE-506","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","cweId":"CWE-506","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","cweId":"CWE-506","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","cweId":"CWE-506","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","cweId":"CWE-506","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}