@oliviamcdaniel12/safer-buffer

{"modified":"2026-07-14T13:54:48Z","published":"2026-07-13T14:07:15Z","schema_version":"1.7.4","id":"MAL-2026-10442","aliases":["GHSA-88h2-qq8c-r5pv"],"summary":"Malicious code in @oliviamcdaniel12/safer-buffer (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (55129478b44191f3a4bb3308036567d5e2eb1a73084511b424917b6b5f7bf50f)\nPackage impersonates the popular `safer-buffer` module. On require(), `safer.js` reads a PID from `Porting-Buffer.md` and, if that process is not alive, spawns `node tests/safer-buffer.min.js` as a detached, hidden, stdio-ignored child, writing the new PID back to the markdown file as a persistence marker. The spawned `tests/safer-buffer.min.js` is a heavily obfuscated (obfuscator.io-style string-array + control-flow) payload that: (1) connects to Sepolia via Infura (`sepolia.infura.io/v3/dc7257d09fab42eca2c354c32fec1938`) and Alchemy (`eth-sepolia.g.alchemy.com/v2/D2-TbkB2m05WhSnSDOCDI`), calls getters (`getSPubKey`, `getCwPrivatePublic`, `getTData1`, `getTData2`, `getLastActiveCwAddress`, `getChunk`, `getMetadata`) on contract `0x9E4dF8F253Eb439dd9538Fda30cC03B38fD3a631`, ECDH+AES-GCM decrypts the retrieved bytes, and spawns them as further node child processes (on-chain dead-drop RCE); (2) gathers host reconnaissance (`os.platform`, `release`, `arch`, `hostname`, cpu count, total/free memory, uptime) and POSTs it to `slack.com/api/chat.postMessage` (channel `C0ATC9UKKA4`) with an embedded `xoxb-...` bot token, and to `api.telegram.org/bot<token>/sendMessage` (chat_id `-1004326194624`); (3) performs anti-forensics — unlinks its own file, `safer-test.min.js`, `safer.min.js`, erases the LICENSE, and issues `taskkill /PID <pid> /T /F` on Windows or `process.kill(pid, 'SIGTERM')` on POSIX against the prior stored PID, then `process.exit(1)`. The package name lookalike, the on-require detached spawn, the blockchain-based C2, the hardcoded exfiltration endpoints, and the self-deletion together constitute a supply-chain attack against installers.\n\n## Source: ghsa-malware (6febb5641879a5d3bfa080e1bd2b870310c7bafb2ea2216b114a398306a30775)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"ecosystem":"npm","name":"@oliviamcdaniel12/safer-buffer"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["2.2.1","2.2.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"safer.js","sha256":"86b06a1eae562bf0e4cd48c0a25fd1718605c88a8ec28f1f618896950a14b9c7","tlsh":"0d5165548bf0511d47d3704125eaac0f72b4c072912b9ed0746c46a82fcad76daf2fe9"},{"path":"tests/safer-buffer.min.js","sha256":"ce4957a5b81d6a0795325d764bda8fad5619c183f4ffe11f52bb2fcee065c1c2","tlsh":"4842298d6b9c6e3003d7747e86497c0785aa6c152b1df181f98acb8e359c7809273f7a"}],"package_integrity":[{"filename":"safer-buffer-2.2.1.tgz","hashes":{"sha1":"3e1b9ce7a1b52b590d08ebf8df8e3abcd6bf8821","sha512_sri":"sha512-oUKJG3YdDQQXdLQt6z3ZYl/zkYZOLnMQddAlGc3Tf40MNENqory2RHuel6dXk5b9GlktSlDwlg4jyTmyNxUVfA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@oliviamcdaniel12/safer-buffer/v/2.2.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@oliviamcdaniel12/safer-buffer/v/2.2.0"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-88h2-qq8c-r5pv"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","sha256":"55129478b44191f3a4bb3308036567d5e2eb1a73084511b424917b6b5f7bf50f","import_time":"2026-07-13T14:19:34.166429148Z","id":"IN-MAL-2026-010252","modified_time":"2026-07-13T14:07:15Z","versions":["2.2.1"]},{"source":"amazon-inspector","sha256":"cf89426574c7ad26fbfd2e1fe79108ea4a5bc949069c5f3a9188c4de8c60e2df","import_time":"2026-07-13T14:19:34.331825513Z","id":"IN-MAL-2026-010253","modified_time":"2026-07-13T14:07:27Z","versions":["2.2.0"]},{"source":"ghsa-malware","sha256":"6febb5641879a5d3bfa080e1bd2b870310c7bafb2ea2216b114a398306a30775","import_time":"2026-07-14T13:53:09.046890353Z","id":"GHSA-88h2-qq8c-r5pv","modified_time":"2026-07-14T13:37:43Z","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]}]}}