@ghost_debugger/nanocache

{"modified":"2026-08-14T19:22:27Z","published":"2026-08-14T19:22:27Z","schema_version":"1.7.4","id":"MAL-2026-14046","summary":"Malicious code in @ghost_debugger/nanocache (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c027fa29f4577bd052bfda553a617994365ea5855216b877e900610542f4bcce)\nOn require/import, the package spawns a bundled 1.1 MB Windows executable at vendor/nanocache.exe as a detached background process with stdio ignored, windowsHide set, and child.unref() so it survives parent exit. The declared purpose is an in-memory LRU+TTL cache, which does not require a native background process, and the binary is not built from source shipped in the tarball. Strings inside the executable include `/ws/agent`, `disconnect`, `update`, and `exit_code`, consistent with a WebSocket-based remote agent that accepts commands from a remote controller. The README further describes vendor/nanocache.exe as a drop-in slot for an arbitrary Windows executable, indicating the npm module functions as a generic launcher for the bundled binary. Installing or importing the package on a Windows host results in an opaque, hidden native process being launched under a cache-library cover story, giving a remote party persistent control over the installer's machine.\n","affected":[{"package":{"ecosystem":"npm","name":"@ghost_debugger/nanocache"},"versions":["0.1.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/index.cjs","sha256":"749efc05d8690b246bbb05c75392f1ee8907493293387f9dc703b792349c5319","tlsh":"0402a74937f722991db211f63f1ba043b72c402b1246dda4baac43bc6f8167542f59b9"},{"path":"vendor/nanocache.exe","sha256":"656eccdd2123d3e44bb8d961d1b75154dedbf9a9a66dd7569f3176e3a78acdb4","tlsh":"ad454c17e2a345fcc56bc1b4965787b2b970b8694234bd6e1e94d3322f23e504f2eb24"},{"path":"README.md","sha256":"3f898e24a7a0894f9b4cb3460a8c69626e9d5c67c4a17ed4aefd04dc869c1100","tlsh":"0bc1737a3f0203352db7d2b5379e72e2ef25521e271268e4786d56bd230629c40be9d2"}],"package_integrity":[{"filename":"nanocache-0.1.1.tgz","hashes":{"sha1":"1e612a2d650cb42b4065f034a68a7d37863e1c08","sha512_sri":"sha512-oQu9wQoHagw0l7pq5AmYaAuhiEwQaegynom7ht7bVHohoNoeEq0Ji3twFgMMvc+eNRZZxKAOFDTJvn1MI2bXjA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ghost_debugger/nanocache/v/0.1.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017917","import_time":"2026-08-14T19:24:34.333515532Z","modified_time":"2026-08-14T19:22:27Z","sha256":"c027fa29f4577bd052bfda553a617994365ea5855216b877e900610542f4bcce","source":"amazon-inspector","versions":["0.1.1"]}]}}