loading-sessions

{"schema_version":"1.7.4","id":"MAL-2026-10471","published":"2026-07-13T18:54:09Z","modified":"2026-09-01T11:20:27.818395918Z","aliases":["GHSA-qrjp-fmwp-2rjq"],"summary":"Malicious code in loading-sessions (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ed919f49d3732fb5d4bd8b177022ed58d9c08b2cded5a6141e2da07c66966a94)\nPackage name impersonates the pino logger (exports module.exports.pino, ships pino-style files lib/proto.js, lib/levels.js, lib/redaction.js, lib/multistream.js, lib/transport.js, copies pino keywords ['fast','logger','stream','json']). When the exported middleware is invoked, index.js spawns a detached `node lib/caller.js` child. lib/caller.js base64-decodes a hardcoded URL (https://api.jsonstorage.net/v1/json/2ef8c758-a96f-459e-b036-b3b90379a165/a179ea35-b962-4722-b3f1-e28316d1a44a) disguised as a `DEV_API_KEY` env-var fake, GETs the JSON document, and passes the response's `data.cookie` string to `new Function.constructor('require', s)` and invokes it with `require`. The fetched content is attacker-controlled and mutable, runs with full Node `require` access, retries up to 5 times, and is detached so failures are silent. Headers (`x-secret-key`) are also base64-decoded from masquerading env-var names. This is a classic remote-code dropper hidden behind a typosquat lure.\n","affected":[{"package":{"name":"loading-sessions","ecosystem":"npm"},"versions":["6.13.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/caller.js","sha256":"37e9dde0f35864e2ea8dcd4c8b5324ef50e3798195d04c30ba6938352af702db","tlsh":"1b01af9934fe541c015112e9171fa1326050e4673d86e6c83b4c87129fa667e6e93adf"},{"path":"index.js","sha256":"2956b023858d706a5e241cd28b845088e5f414c5f70bd5d8cb73cb427d081065","tlsh":"5d213c81b9f11188065cd9c8b569e53a38e3c4377207b9b0e9ec87862bcf2080272ad7"}],"package_integrity":[{"filename":"loading-sessions-6.13.2.tgz","hashes":{"sha1":"277bc3b8cbccebcc3855a115cdac0aca086d5592","sha512_sri":"sha512-3wpv2/9u/m09IGUZbUi4yockVcbtTE/djxJux3Qf4yLJmUXO1q8TClJTz2VtDKzrF1QHVeQqgM/UrASgFdYLNw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/loading-sessions/v/6.13.2"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-qrjp-fmwp-2rjq"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010290","import_time":"2026-07-13T19:00:27.307313594Z","modified_time":"2026-07-13T18:54:09Z","sha256":"ed919f49d3732fb5d4bd8b177022ed58d9c08b2cded5a6141e2da07c66966a94","source":"amazon-inspector","versions":["6.13.2"]},{"id":"RLMA-2026-05569","import_time":"2026-07-20T13:14:48.880010295Z","modified_time":"2026-07-20T10:48:54Z","sha256":"2907d99272726cc1d10648311e8b9ae77b53164a89ab868a510dc1d6f1c4c11f","source":"reversing-labs","versions":["6.13.2"]},{"id":"RLUA-2026-06309","import_time":"2026-09-01T11:18:11.269094431Z","modified_time":"2026-08-24T16:57:57Z","sha256":"a1d8bcdcd684fcc154d56384b6a7779d786910d7133cf66534d0e270b090bb0d","source":"reversing-labs"}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}