@wololasod/tiny-id

{"schema_version":"1.7.4","id":"MAL-2026-12331","published":"2026-08-05T12:50:23Z","modified":"2026-08-15T17:42:11.792946832Z","summary":"Malicious code in @wololasod/tiny-id (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5b3ca8617b237bb3d8fd7d14aa18554118397e7b7faaea2e87cdd8433fef7a8f)\nThe package advertises itself as a tiny ID generator but its main entry dist/index.cjs contains an obfuscator.io + RC4 string-array VM that, on require/import, resolves a platform-specific configuration (win32/linux), downloads a remote executable over https to a temp/APPDATA path, and executes it via child_process.spawn (VBS launcher on Windows, direct spawn on Linux), then deletes the staged file. Staging filename observed: 'nupkg_system.diagnostics.performancecounter.8.0.0.py'. The loader additionally re-launches itself via spawn(process.execPath, [__filename], {detached:true, stdio:'ignore', windowsHide:true, env:{...process.env, RUN_PAYLOAD:...}}) and unrefs the child, producing a hidden, detached process that survives the parent. The loader includes obfuscator.io anti-analysis features: RC4-decoded string array, hex-named identifiers, eval.toString()/Function.prototype.bind.toString() '[native code]' integrity checks, and a djb2 caller-hash gate ('_$h!== 0x74F28336') that crashes if the code is reformatted. The same obfuscated dropper is also shipped in dist/index.d.ts, which is declared as the TypeScript types entry — a.d.ts file should contain pure type declarations, not executable code. None of this behavior relates to ID generation.\n","affected":[{"package":{"name":"@wololasod/tiny-id","ecosystem":"npm"},"versions":["0.1.1","0.1.3","0.1.0","0.1.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/index.cjs","sha256":"ebf890ffdd3dda2776a0e514a87b7a274578457b8e902c0d1cbc088444a378f9","tlsh":"a4a1f85fb3f272a653db0259b07f6204dbbb4675040e0118f118849a38a06b993f3fb9"},{"path":"dist/index.d.ts","sha256":"a17694583d51c6672704f738163d9e9cc225390b2a14588a591a5974814c4389","tlsh":"dee1a9612cb6b12306f2d2b4dbd29919e51741232322419efdfca3512f3312d926dfda"}],"package_integrity":[{"filename":"tiny-id-0.1.1.tgz","hashes":{"sha1":"133a08f5b143356d793ab87acd1710140365cc4b","sha512_sri":"sha512-5XUh+yuObKsYq3MOa6Pe66f1jvatX+5lDc27M9LeNVW58H7yNZxOafUtUJqe41m/rlDjc4Kqf70ur8OgLNTSrQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@wololasod/tiny-id/v/0.1.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@wololasod/tiny-id/v/0.1.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@wololasod/tiny-id/v/0.1.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@wololasod/tiny-id/v/0.1.2"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014783","import_time":"2026-08-05T13:08:46.144725876Z","modified_time":"2026-08-05T12:50:39Z","sha256":"4b86e785db5111f091312c26dc471a90839c0785a4989f25065555c82c64dd76","source":"amazon-inspector","versions":["0.1.1"]},{"id":"IN-MAL-2026-014784","import_time":"2026-08-05T13:08:46.205758778Z","modified_time":"2026-08-05T12:50:49Z","sha256":"5b3ca8617b237bb3d8fd7d14aa18554118397e7b7faaea2e87cdd8433fef7a8f","source":"amazon-inspector","versions":["0.1.3"]},{"id":"IN-MAL-2026-014781","import_time":"2026-08-05T13:08:45.957063598Z","modified_time":"2026-08-05T12:50:23Z","sha256":"84d9d02380d22d1874c6948d91ef38033e2f7ebfb233a89c1e1b3f4cc2bc6ef9","source":"amazon-inspector","versions":["0.1.0"]},{"id":"IN-MAL-2026-017969","import_time":"2026-08-15T17:40:29.803125723Z","modified_time":"2026-08-15T17:38:14Z","sha256":"b56382180b3d6a1792bbc0da800de55877e504707a461973d97888e137f0c0b8","source":"amazon-inspector","versions":["0.1.2"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}