npm-dc-dev

{"modified":"2026-08-05T21:16:31Z","published":"2026-08-05T21:16:31Z","schema_version":"1.7.4","id":"MAL-2026-13378","summary":"Malicious code in npm-dc-dev (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (91248167ea052dfca231e837bd645444f362dc087be9a7c04f1cf4aeec4d6723)\npackage.json declares `\"postinstall\": \"node test.js\"`. test.js top-level `require('.')`s index.js and awaits an exported `from_str()`. index.js consists of a single `Function(\"k4Wmku\", \"...\")` invocation whose ~170KB body is encoded with a custom 85-character alphabet and a shuffled string array; standard deobfuscation does not recover the payload. On `npm install`, the postinstall hook constructs and runs this opaque code on the installer's machine, with `child_process`, `axios`, and `form-data` available as declared dependencies. Package metadata is generic (blank author and description, name `npm-dc-dev`) and no legitimate library surface is exported. The install-time construction and execution of an unreadable dynamic payload matches the install-time remote-code-execution pattern; no benign reason exists for this shape.\n","affected":[{"package":{"ecosystem":"npm","name":"npm-dc-dev"},"versions":["1.1.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"8561e8350f98ddf0dee9966cd077846d558f385cda8bf6d451ef2ec3b24290de","tlsh":"d8f3cdd8121aa91ff26db504503bdc1a64b3cce8f69cfaf45580e2c87138cb49ae95d7"},{"path":"package.json","sha256":"0c08acce90a5836f00603d2868e4ed98e135b31ffce6afb3011241b0d2e632a0","tlsh":"48e09210cf289a2328c425a41d7e4517b6a28d1b0118bc0c33cf661c8b9d63b24ba65e"}],"package_integrity":[{"filename":"npm-dc-dev-1.1.1.tgz","hashes":{"sha1":"f92838b02a14fb29cbba6611215269a107851d62","sha512_sri":"sha512-Rw1pKcLhnfzoYlRp0vCc26zbl3bmqCQYcLnefQiJ4GOREf/1S7+t4cMPd4LpSu7RuzXbB8B4xrizHX5ExMUN3Q=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/npm-dc-dev/v/1.1.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015891","import_time":"2026-08-05T21:31:20.94299478Z","modified_time":"2026-08-05T21:16:31Z","sha256":"91248167ea052dfca231e837bd645444f362dc087be9a7c04f1cf4aeec4d6723","source":"amazon-inspector","versions":["1.1.1"]}]}}