@nzeros/codebreak

{"modified":"2026-08-11T15:26:15Z","published":"2026-08-11T15:26:15Z","schema_version":"1.7.4","id":"MAL-2026-13736","summary":"Malicious code in @nzeros/codebreak (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (cf2d80dd4a014bd04f0f01ef666cc4a6a09bb010a37e572a0eb9a3e0298ed5fe)\nThe package declares native/solver.c as the source of a small C minimax solver and advertises vendor/solver-<platform>-<arch> as its compiled output. The darwin-arm64 slot contains a ~34KB Mach-O consistent with that C source, but vendor/solver-darwin-x64 and vendor/solver-linux-x64 are identical 33,648,788-byte Linux ELF Go binaries (same sha256 05b69666...4420) that link net/http, os/exec, crypto/chacha8, and reference /proc/self/. The postinstall script invokes spawnSync(BINARY, ['selftest']) on install, so on Linux x64 hosts the shipped opaque Go binary runs automatically at install time. The binary's linked packages (network client, process execution, symmetric crypto) and ~1000x size inflation over any plausible build of the declared C algorithm are inconsistent with the documented purpose, and the darwin-x64 slot being populated with a Linux ELF further indicates the vendor tree was not built from the shipped C source. The install-time execution path against unverified, purpose-mismatched bytes on Linux x64 is a fetch-and-execute equivalent embedded in the tarball rather than downloaded, and the destination of any network activity performed by the Go binary cannot be determined from strings alone.\n","affected":[{"package":{"ecosystem":"npm","name":"@nzeros/codebreak"},"versions":["1.3.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"vendor/solver-linux-x64","sha256":"05b69666193e8fa719c37df22833bf36a120b15e2408a9ecd47e34f140a44420","tlsh":"43773a47e8e21a94c4aac670d525816bbbb13c4d2b7c23eb1790f3702f36bd06a76751"},{"path":"vendor/solver-darwin-x64","sha256":"05b69666193e8fa719c37df22833bf36a120b15e2408a9ecd47e34f140a44420","tlsh":"43773a47e8e21a94c4aac670d525816bbbb13c4d2b7c23eb1790f3702f36bd06a76751"}],"package_integrity":[{"filename":"codebreak-1.3.0.tgz","hashes":{"sha1":"962691f45a73c96d349d37f902f8360ef5457220","sha512_sri":"sha512-K2TbeRuTxuuNf2HM13a8NOnfNaLRlUDMBtcfWy5ywU054MZ8glQEjfkI/2r/dKjVH9KWFxsdNJbDEcaF5w/yOw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@nzeros/codebreak/v/1.3.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017370","import_time":"2026-08-11T15:26:49.383297144Z","modified_time":"2026-08-11T15:26:15Z","sha256":"cf2d80dd4a014bd04f0f01ef666cc4a6a09bb010a37e572a0eb9a3e0298ed5fe","source":"amazon-inspector","versions":["1.3.0"]}]}}