1239i32049i

{"modified":"2026-08-05T09:04:51Z","published":"2026-08-05T09:04:51Z","schema_version":"1.7.4","id":"MAL-2026-12117","summary":"Malicious code in 1239i32049i (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6c99f6d077df7b1209fb59dafa8641b14b3947d321379bc6ad22f2660d3d4c7b)\nPackage declares a postinstall script that runs dist/index.js, the sole shipped file, which is heavily obfuscated with javascript-obfuscator (rotated string array, _0xNNNN identifiers, control-flow dispatch). At install time it reads process.env.P, issues an HTTPS GET to https://dropper-crm.vercel.app/api/payload/<P>, base64-decodes the response body, and executes it via new Function('require', decoded), granting the remote endpoint arbitrary code execution with require access on the installing machine. The package name is a numeric string with no documented functionality, no README, and no legitimate purpose beyond delivery of the remote payload.\n","affected":[{"package":{"ecosystem":"npm","name":"1239i32049i"},"versions":["0.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/index.js","sha256":"3f2646e7a3539fa37e2d1a31c7ef3ffa1b4516e2ec14a613be0f72089d71c07d","tlsh":"f541fe647fc0361573015eaa3b3a66d6c533d864b8c08d8ba1081a96bd50230cac2f35"}],"package_integrity":[{"filename":"1239i32049i-0.1.0.tgz","hashes":{"sha1":"9de23143f9eaf9fe0f3162701bbc525836ea3dfe","sha512_sri":"sha512-/mWQKJzsXIqYtR/xOVu7vUj5wANpz7NtaS3RHUy/9DN485bFlcHi8i8DbakO8O0/Fyhc1BEF3CCC3rsNEXLW9Q=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/1239i32049i/v/0.1.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014536","import_time":"2026-08-05T09:28:23.313852758Z","modified_time":"2026-08-05T09:04:51Z","sha256":"6c99f6d077df7b1209fb59dafa8641b14b3947d321379bc6ad22f2660d3d4c7b","source":"amazon-inspector","versions":["0.1.0"]}]}}