async-mutex-v3

{"schema_version":"1.7.4","id":"MAL-2026-12514","published":"2026-08-05T13:13:00Z","modified":"2026-09-24T09:23:26.044738510Z","summary":"Malicious code in async-mutex-v3 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (699abe52cb380ae997f200e0615bfce84cd52d11b98a54244ce5b30478fab336)\nPackage name typosquats `async-mutex` but ships unrelated functionality. The default export `getPlugin` in index.js issues an HTTP request to a hardcoded bare IP endpoint (http://46.183.25.232:45000/icons/108) and passes the response's `credits` field into `new Function('require','module',...,'Promise', data.credits)`, executing attacker-controlled JavaScript with Node privileges (access to require, process, Buffer). Cover-story variable names (`IconProvider`, `iconDomain` referencing cloudflare/fastly/akamai/gcore, path `/ajax/libs/font-awesome/...`, header `bearrtoken: 'logo'`) frame the code as an icon CDN helper, while the actually-used path hits the bare IP. Declared dependencies (better-sqlite3, @primno/dpapi, node-machine-id) are consistent with a credential-stealer post-exploitation pipeline. Any consumer that requires this package and invokes the default export executes whatever JavaScript the remote server returns.\n","affected":[{"package":{"name":"async-mutex-v3","ecosystem":"npm"},"versions":["3.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"ce2c680ca6b7355d73cbc131465fc6b2f2508f367b57ecb27a3b05e6e247213f","tlsh":"30c1616546fa31a36a67e4eef30f10027165e313365de971f48e42902fca568e5f24e8"}],"package_integrity":[{"filename":"async-mutex-v3-3.1.0.tgz","hashes":{"sha1":"f4adff48d931d29fc8bd875bab153d0cf039bbe2","sha512_sri":"sha512-5gHn8hGVKY84Z+ldKvzIGUrxshf6miV5VMmXSZAsH+smtNWJZNKlOpmt9asxDfQ3fMKLIYm5ySf79mhQfcENbQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/async-mutex-v3/v/3.1.0"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014928","import_time":"2026-08-05T14:19:43.859834756Z","modified_time":"2026-08-05T13:13:00Z","sha256":"699abe52cb380ae997f200e0615bfce84cd52d11b98a54244ce5b30478fab336","source":"amazon-inspector","versions":["3.1.0"]},{"id":"RLMA-2026-10694","import_time":"2026-09-24T09:21:32.899740999Z","modified_time":"2026-09-22T17:17:48Z","sha256":"02a9044d7c6c95a61f61c33e1f6dd9887d40772d21dbc752b46e083e4d053db0","source":"reversing-labs","versions":["3.1.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}