core-js-buffer

{"modified":"2026-08-13T17:15:39Z","published":"2026-08-13T17:15:39Z","schema_version":"1.7.4","id":"MAL-2026-13945","summary":"Malicious code in core-js-buffer (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ec43d0c13a26ec0a6e6dacf51f52a66f48c7dbce7f4a00dbcb72a0749fa6b4e3)\nThe package's postinstall script (package.json declares \"postinstall\": \"node init.js\") performs two hostile actions at install time. First, init.js POSTs installer host and user identifiers — os.hostname(), os.userInfo().username, os.platform(), architecture, Node version, OS release, package name/version, and timestamp — to https://core-js-buffer.domaup-com.workers.dev/report with TLS verification disabled (rejectUnauthorized: false). Second, it fetches an AES-256-GCM encrypted blob from https://core-js-buffer.domaup-com.workers.dev/e, decrypts it with a key derived from a fixed seed, writes the resulting Python code under ~/.cache/core-js-buffer/modules/, and spawns a detached Python process to execute it. Execution is gated by a dev-machine check (presence of Desktop/Documents/Downloads directories) to skip CI/sandbox environments, throttled to at most once per day via a cached marker, and only runs if the decrypted payload contains the string 'TelemetrySender' — evasion controls consistent with a malicious dropper rather than declared telemetry. The package name mimics core-js, a widely used JavaScript polyfill library.\n","affected":[{"package":{"ecosystem":"npm","name":"core-js-buffer"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"init.js","sha256":"d2151c94c8fadefee3ffca12886a08e04e24a3f0cffae2dee54b36e1dbd6274c","tlsh":"a4a12ff669f2a23032b2f25d826f904aa267f013714aea90f85d76501fdd02c47a5df8"}],"package_integrity":[{"filename":"core-js-buffer-1.0.0.tgz","hashes":{"sha1":"f278e4914aae0c10806f0af6a2b362730174cd7b","sha512_sri":"sha512-gW3u05kK4etFjmHomZQFF00WZg8cF4Jwqp4XMsUCKIcRyApe/uJdsnSuQ5QJ4Ne+w7+TCVmRQMrUyrEtG+wL2w=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/core-js-buffer/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017634","import_time":"2026-08-13T17:24:45.320278313Z","modified_time":"2026-08-13T17:15:39Z","sha256":"ec43d0c13a26ec0a6e6dacf51f52a66f48c7dbce7f4a00dbcb72a0749fa6b4e3","source":"amazon-inspector","versions":["1.0.0"]}]}}