mui-option

{"modified":"2026-07-16T18:36:24Z","published":"2026-07-16T18:36:24Z","schema_version":"1.7.4","id":"MAL-2026-10738","summary":"Malicious code in mui-option (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8e1c3ec117eaeedbd4c3f64c2fec97d44e115d400c7e52082b7d6cc28f7c59ec)\nThe sole shipped file index.js is heavily obfuscated with a base64+RC4 string-array decoder that hides all module names, URLs, and method identifiers. On import (main entrypoint), it requires child_process, os, fs, path, crypto and https, issues an https.get to a runtime-decoded URL, splits the response on ':' into an IV and ciphertext, derives a key with crypto.scryptSync, decrypts the payload with crypto.createDecipheriv, writes the decrypted bytes to a file under os.tmpdir(), and executes that file via child_process.exec. The package has no legitimate advertised functionality, its name resembles the MUI ecosystem, and no other code path exists. Any project that requires mui-option triggers execution of attacker-controlled native code on the installer host. The tarball also ships npm_recovery_codes.txt containing five 64-character hex strings matching the format of npm 2FA recovery codes, suggesting a publishing-account compromise.\n","affected":[{"package":{"ecosystem":"npm","name":"mui-option"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"e3e7b2e8b98ba8d52f781c1c1ebc8299bdc85da4fc2e5f50be38685a76d03775","tlsh":"92b297c83fc1b0d04627b0fba95b6594e13a6cccb38c9449f7a6f068fd58314e566b68"},{"path":"npm_recovery_codes.txt","sha256":"b355830a244eff00049a313d6d47abaab1a5e2b418c04c9372a56ef268e4abbe","tlsh":"0ee0c06d98485b120d56daaad5582a031b6507218b7474252cdb85a10252d63db18814"}],"package_integrity":[{"filename":"mui-option-1.0.0.tgz","hashes":{"sha1":"eac439d266c9365e9dfb62a9c47627a2d3bf8227","sha512_sri":"sha512-B1TDWJLQx59YgsfC3dLm+luiywSZwZuBxmb5Q7crxMokqRxgvc4YVdVoL/BGYoE7plGGMzLJIozrYZ6WBkGbdw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/mui-option/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010713","import_time":"2026-07-16T18:54:00.65371986Z","modified_time":"2026-07-16T18:36:24Z","sha256":"8e1c3ec117eaeedbd4c3f64c2fec97d44e115d400c7e52082b7d6cc28f7c59ec","source":"amazon-inspector","versions":["1.0.0"]}]}}