raectjs

{"modified":"2026-08-18T23:59:57Z","published":"2026-08-18T23:59:57Z","schema_version":"1.7.4","id":"MAL-2026-14187","summary":"Malicious code in raectjs (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f75a611c33224c779330b8d5313702dc44f20d197dd96f62fb236982281b9d09)\nscripts/postinstall.js runs on npm install and performs two attacker-beneficial actions. First, it POSTs a JSON platform snapshot to the hardcoded bare-IP endpoint http://193.70.34.101:20099/vote, with the host string reconstructed at runtime by joining ['193','70','34','101'] to evade static hostname matching. Second, it XOR-decodes (key 'stf2026') an embedded byte array (ADDON_ENC) into a URL pointing at a GitHub releases/download/.../main.exe under an attacker-controlled account, fetches the payload into %TEMP%\\main.exe, and spawns it detached with stdio:'ignore' and windowsHide:true. On WSL/virtualized Linux it XOR-decodes a PowerShell bridge command and script (BRIDGE_LAUNCHER_ENC, BRIDGE_SCRIPT_PRE_ENC, BRIDGE_SCRIPT_POST_ENC) to invoke the same payload on the Windows host. The fetched binary has no pinning, no hash or signature verification, and the package name uses a cover story ('addon', 'TELEMETRY.addon') while shipping no native source consistent with a real addon (index.js exports {}). Package has no legitimate purpose beyond delivering the dropper.\n","affected":[{"package":{"ecosystem":"npm","name":"raectjs"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"scripts/postinstall.js","sha256":"4f512d415af57f24a4bddc03c85da557c1b8c78ad054cadca3a9b73e4442b034","tlsh":"17d13fc61ef59035874bf96884cf9d13b2a6c207330e4a65fb8f42107f5792c85a69d6"}],"package_integrity":[{"filename":"raectjs-1.0.0.tgz","hashes":{"sha1":"7c78e6639b7fba51c644f24e03d72ad84b34bd27","sha512_sri":"sha512-s0WGn4q3qY4lCxl63sdzMmmERnKlnn0XyYjxS5wUlRIyTaGm/NRAAw4hItE0cxA/Hd2/DyQb+rrqiuBuo9k0eg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/raectjs/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018255","import_time":"2026-08-19T00:21:13.617942599Z","modified_time":"2026-08-18T23:59:57Z","sha256":"f75a611c33224c779330b8d5313702dc44f20d197dd96f62fb236982281b9d09","source":"amazon-inspector","versions":["1.0.0"]}]}}