entropyeasybots

{"modified":"2026-08-04T22:07:52Z","published":"2026-08-04T22:07:52Z","schema_version":"1.7.4","id":"MAL-2026-11539","summary":"Malicious code in entropyeasybots (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (82e7d0cd2ef4870fdc4484c815737ade78e04bdac4843df02f5cf876cfa3dbaa)\nindex.js decodes a base64-obfuscated IP (85.137.253.124) and connects a spawned /bin/sh subprocess's stdio to a TCP socket at 85.137.253.124:1111, granting remote shell access on the installer's host. package.json declares `postinstall: sudo node install.js`, and install.js uses node-linux's Service API to register a systemd unit named `CustomBot` that runs index.js with maxRestarts:10, providing root-level persistence of the backdoor across reboots. The C2 IP is stored as a base64 string and reconstructed at runtime to hide the destination.\n","affected":[{"package":{"ecosystem":"npm","name":"entropyeasybots"},"versions":["2.0.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"52875c52db0fbcb6860cbea25050d34206496f2abf4ba04238e1161d0f2e2da0","tlsh":"8401ce58a4b62579107330a1c93fca1b2b6b40263202e1b0b25c44d91fa761d623bbde"},{"path":"package.json","sha256":"63a6c73660e3151b802efad570e689925545a0c6fb111103829c1d3c3ed74be0","tlsh":"e9d02b040c21a73339c5aee96c63504fbfcb4758510888180397411413ed7bf44bf30a"}],"package_integrity":[{"filename":"entropyeasybots-2.0.2.tgz","hashes":{"sha1":"55de0d7a5bffa27272270be32a98240147639671","sha512_sri":"sha512-b5cUb/ELxghXMkhHqmXFdPsCoBstv58IzfjQz+hOs28Jf7P5nsq2uoj5tQyA5ZBAroyDGc7DxQmNKdjThm4sbA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/entropyeasybots/v/2.0.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-011343","import_time":"2026-08-04T22:30:11.842874863Z","modified_time":"2026-08-04T22:07:52Z","sha256":"82e7d0cd2ef4870fdc4484c815737ade78e04bdac4843df02f5cf876cfa3dbaa","source":"amazon-inspector","versions":["2.0.2"]}]}}