core-js-gns

{"modified":"2026-08-19T00:00:05Z","published":"2026-08-19T00:00:05Z","schema_version":"1.7.4","id":"MAL-2026-14175","summary":"Malicious code in core-js-gns (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ae5eadad92952db436b03dd9673b34d203d9296b0913389de2aa0d9fef441631)\nThe package's postinstall hook (`package.json` → `node init.js`) runs an installer-side dropper. init.js gates on developer-machine heuristics (presence of Desktop/Documents/Downloads directories) and a 24-hour skip marker, then POSTs hostname, username, platform, architecture, Node version, OS release, and package name/version to https://core-js-buffer.domaup-com.workers.dev/report. It then HTTP GETs an AES-256-GCM ciphertext from the same host with TLS verification disabled (`rejectUnauthorized: false`), decrypts it with a key derived from a hardcoded seed, checks the plaintext contains the cover-story string `TelemetrySender`, writes the result to `~/.cache/core-js-buffer/modules/runtime.py`, and spawns Python detached (`stdio:'ignore'`, `.unref()`) to execute it. The package name mimics the legitimate `core-js` library. Behavior is arbitrary remote code execution on the installer's machine, fetched from an attacker-controlled endpoint at npm install time, preceded by installer identifier exfiltration to the same endpoint.\n","affected":[{"package":{"ecosystem":"npm","name":"core-js-gns"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"init.js","sha256":"d2151c94c8fadefee3ffca12886a08e04e24a3f0cffae2dee54b36e1dbd6274c","tlsh":"a4a12ff669f2a23032b2f25d826f904aa267f013714aea90f85d76501fdd02c47a5df8"}],"package_integrity":[{"filename":"core-js-gns-1.0.0.tgz","hashes":{"sha1":"40686e28bfe789121574e8841689f62677add4e1","sha512_sri":"sha512-8mdRW8P8HpMMH2Nceh0p3X1FWMwyat3PVOimJ6yX7lxdOk/AEsjrnqT1Ru5LsHSCxr7AJa4mFOCKkwMCInWmlA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/core-js-gns/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018256","import_time":"2026-08-19T00:21:13.710428127Z","modified_time":"2026-08-19T00:00:05Z","sha256":"ae5eadad92952db436b03dd9673b34d203d9296b0913389de2aa0d9fef441631","source":"amazon-inspector","versions":["1.0.0"]}]}}