crypto-javas

{"schema_version":"1.7.4","id":"MAL-2026-12359","published":"2026-08-05T12:59:52Z","modified":"2026-08-19T04:20:02.244905769Z","summary":"Malicious code in crypto-javas (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (75003e4aab1668c5d9b7f1216e6b356473ebb6e834da3a015e920807e8717ed9)\nThe package's postinstall hook runs setup.js, which enumerates process.env (excluding only a small OS blocklist for PATH/HOME/USER/SHELL/LANG), collects every remaining variable's value together with CI job metadata (CI_JOB_ID, GITHUB_RUN_ID, project, commit, branch, hostname), and HTTPS-POSTs the payload to a URL and API key read from BACKEND_URL/BACKEND_API_KEY, package.json.crypto-javas.backend,.crypto-config.json, or.env in the current working directory. The declared main entrypoint index.js additionally invokes autoExecute() at module top level, instantiating SecretsHandler.readFromEnvironment and sendToBackend so that every require/import of the package re-runs the same environment-variable harvest and POST. The behavior is undisclosed in the README, which presents the package as @wizlabs/js-crypto (a typosquat-style mismatch with the actual name crypto-javas); repository is the placeholder gitlab.com/example/js-crypto and author is a generic DevSecOps handle. In a CI runner this ships AWS_*, GITHUB_TOKEN, NPM_TOKEN, CI_JOB_TOKEN and any other pipeline secrets to an attacker-configurable backend.\n","affected":[{"package":{"name":"crypto-javas","ecosystem":"npm"},"versions":["2.0.4","2.0.7","2.0.8","2.0.9","2.0.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"setup.js","sha256":"fee2025c686373d93d0e8ad23deb2e27d9b6eca290b81c8bdc45177c47ef802b","tlsh":"69b1970645fd64020b63565d67af6212bb75f5032e08fe54bbcd23062f5a22d87f26ec"},{"path":"index.js","sha256":"bff36808e1f67efa2d0633861a0673a5f0da627dcb3095d1c79c7a9b967642d8","tlsh":"60e1a609a5fe64028ba3615e3bdf7202b635e9071e08fe54bacc13455f4a12d8bf17e8"},{"path":"package.json","sha256":"2de99cd8f9fad8c0837133b8cfc2d082676d6fab78f69c56b9cf9fc8845e4e90","tlsh":"47f04c24c8346c633ac85b559d7a0445a4308e174e487c0d33e7522c8f9e2af24ff7ad"}],"package_integrity":[{"filename":"crypto-javas-2.0.4.tgz","hashes":{"sha1":"697a763c51887a9be194e365095951ed4413ef2c","sha512_sri":"sha512-OrnuMW6KyalattYkYhUmTRg2W1LCSc6YpuFuGjiLSKmYwDBFxhBIKlaY30EXCB4Yh17ENrC6lmlJgHIXDaeUhA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/crypto-javas/v/2.0.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/crypto-javas/v/2.0.7"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/crypto-javas/v/2.0.8"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/crypto-javas/v/2.0.9"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/crypto-javas/v/2.0.6"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014845","import_time":"2026-08-05T13:08:50.699774169Z","modified_time":"2026-08-05T13:00:35Z","sha256":"51ea78569a1330ed6c2019a0260ba5e128339c2a1d0b42489d2e84c0408a11e6","source":"amazon-inspector","versions":["2.0.4"]},{"id":"IN-MAL-2026-014843","import_time":"2026-08-05T13:08:50.586702792Z","modified_time":"2026-08-05T13:00:15Z","sha256":"5a8df6a7a735756b97bf8957dfacf2076f6ea39d4fdc8489755ea14e8c89f9c1","source":"amazon-inspector","versions":["2.0.7"]},{"id":"IN-MAL-2026-014840","import_time":"2026-08-05T13:08:50.386658131Z","modified_time":"2026-08-05T12:59:52Z","sha256":"fe1460442a480b91392f6b6b9fde9b5933acca5be28ddd4fc96578099f98e8d5","source":"amazon-inspector","versions":["2.0.8"]},{"id":"IN-MAL-2026-018346","import_time":"2026-08-19T04:18:13.727478259Z","modified_time":"2026-08-19T04:01:06Z","sha256":"5fa838fd808c704b14402aca651c52728f92837bcfb94ce9085c692a5324dd1e","source":"amazon-inspector","versions":["2.0.9"]},{"id":"IN-MAL-2026-018347","import_time":"2026-08-19T04:18:13.75704855Z","modified_time":"2026-08-19T04:01:14Z","sha256":"75003e4aab1668c5d9b7f1216e6b356473ebb6e834da3a015e920807e8717ed9","source":"amazon-inspector","versions":["2.0.6"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}