async-mutex-hook

{"schema_version":"1.7.4","id":"MAL-2026-12339","published":"2026-08-05T12:47:07Z","modified":"2026-09-24T09:23:26.034463094Z","summary":"Malicious code in async-mutex-hook (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (624c93cbd007656467757c5504db29971b220bc36685eda2af6a1d1390715133)\nPackage is published under the name async-mutex-hook and self-describes as a Promise-based mutex library, but ships no mutex implementation. Its exported getPlugin function issues an HTTPS request to the hardcoded bare-IP endpoint https://46.183.25.232:45000/icons/108 and passes the response's `credits` field to `new Function('require','module','exports',...,'Promise', data.credits)`, executing attacker-controlled JavaScript with full Node.js privileges (require, process, Buffer, and shipped dependencies injected). The declared dependencies (@primno/dpapi for Windows DPAPI, better-sqlite3/sqlite3 for browser cookie and login databases, node-machine-id) are unrelated to any mutex functionality and are the standard building blocks for browser-credential and DPAPI theft, matching the capability the remote payload would need to invoke on the installer's host.\n","affected":[{"package":{"name":"async-mutex-hook","ecosystem":"npm"},"versions":["2.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"ce2c680ca6b7355d73cbc131465fc6b2f2508f367b57ecb27a3b05e6e247213f","tlsh":"30c1616546fa31a36a67e4eef30f10027165e313365de971f48e42902fca568e5f24e8"},{"path":"package.json","sha256":"3c35cd56d5f1c18ccd5452864e507aa31c239ec87b004b49d272577ff3f0ba83","tlsh":"46f04911ce21deb314d615976828809aa150d91b8d00fc0c339e866d4f0e56f36fb26c"}],"package_integrity":[{"filename":"async-mutex-hook-2.1.0.tgz","hashes":{"sha1":"38c760af73f28532e5f071265c441b3d2b753a52","sha512_sri":"sha512-j+XJiupEbofuKM1EDdkiVio2yzPClLFcVmiT09Skfg7TuB2mWW+iiM/cX248OrZs0yP3MLhHQdspgnX6EWM9mA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/async-mutex-hook/v/2.1.0"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014760","import_time":"2026-08-05T13:08:44.389086986Z","modified_time":"2026-08-05T12:47:07Z","sha256":"624c93cbd007656467757c5504db29971b220bc36685eda2af6a1d1390715133","source":"amazon-inspector","versions":["2.1.0"]},{"id":"RLMA-2026-10693","import_time":"2026-09-24T09:21:32.84558483Z","modified_time":"2026-09-22T17:17:48Z","sha256":"ab11430d779271b5e2bfe20997073cdfb6a4d6712b175d69b36c22ce57826840","source":"reversing-labs","versions":["2.1.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}