{"id":"MAL-2026-7010","summary":"Malicious code in crypto-promiser (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (25594e7865a7525aebefd2f1fcc8060f144bf202b1986875e1cfd95564f66e88)\ncrypto-promiser@1.0.1 is a typosquat of the legitimate crypto-promise package that ships a dropper in its lifecycle scripts. The declared postinstall runs prepinstall.js, which decodes a base64-hidden URL (aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iL1dEVDFI -\u003e https://jsonkeeper.com/b/WDT1H) via atob, fetches JSON from that anonymous paste host with axios, and pipes the `.cache` field of the response into a detached `node` child process over stdin, executing attacker-controlled JavaScript on npm install. index.js also contains a top-level IIFE that dynamically imports./prepinstall.js, causing the same fetch-and-exec to fire when the package is require()d or imported. The package name is a single-character edit of crypto-promise and mirrors its API surface (hash, hmac, cipher, pbkdf2) as a lure. The remote payload host is anonymous and mutable, the destination is obfuscated behind base64, and executed bytes come from a non-registry third-party paste — arbitrary code execution on the installer machine at install time and at require time.\n","modified":"2026-07-08T21:46:51.343362205Z","published":"2026-07-08T17:31:26Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-008174","sha256":"25594e7865a7525aebefd2f1fcc8060f144bf202b1986875e1cfd95564f66e88","modified_time":"2026-07-08T17:31:26Z","import_time":"2026-07-08T17:40:20.115048959Z","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-008610","sha256":"2a46357d63cf4bf7cac2adab122f202a921500a632c120d7191615172f3a2e78","modified_time":"2026-07-08T20:48:50Z","import_time":"2026-07-08T21:27:50.155796025Z","source":"amazon-inspector","versions":["1.0.2"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/crypto-promiser/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/crypto-promiser/v/1.0.2"}],"affected":[{"package":{"name":"crypto-promiser","ecosystem":"npm","purl":"pkg:npm/crypto-promiser"},"versions":["1.0.1","1.0.2"],"database_specific":{"indicators":{"evidence_files":[{"sha256":"06b348bcac3ed4669e7f9f50522440b5598a044daf06fb8b46d2de310108fc5e","path":"prepinstall.js","tlsh":"41e02b5f313767791f700ed49832c6768d12a020f6c2d1e0a51a80576987746014bfe8"},{"sha256":"72c465459ec2b1ccce5cee1a8357a218107a7da7198a3c396acdc3ac5abc51e5","path":"index.js","tlsh":"6b01d8497efcf0d703d1a0d7453bfb81ed92b0a3b2008b65938bea5cc5e1168c93a594"},{"sha256":"1c951f6f26ba91c72733e967984d8b2d7947df24b604357ae09f3e9a6a13fbc3","path":"package.json","tlsh":"74019c96cc68d9772bc421f26c7a110bf620584b4918fc0a7387860c4bce8bb41bd26d"}],"package_integrity":[{"hashes":{"sha512_sri":"sha512-oSa9+4MnSgkH2oejLOiQj4a2AayVMYW32Q8aHXNDYTw8/Umtm3gdSss6R5bQg4VGlkZtsbPbENjN3fEJGZf4ng==","sha1":"954b3c225f59707243b4b82d327a5c13e598ca34"},"filename":"crypto-promiser-1.0.1.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/crypto-promiser/MAL-2026-7010.json","cwes":[{"name":"Embedded Malicious Code","description":"The product contains code that appears to be malicious in nature.","cweId":"CWE-506"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}]}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}