@lilsccott6x9/devpipe-connector

{"modified":"2026-08-19T02:41:24Z","published":"2026-08-19T02:41:24Z","schema_version":"1.7.4","id":"MAL-2026-14203","summary":"Malicious code in @lilsccott6x9/devpipe-connector (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e8615ec2381e2fc36518a5f991f1a132ffe8c86fc458a7072585bb950644eb1f)\nThe package's postinstall lifecycle hook (package.json declares postinstall=node scripts/setup.js) decodes base64-encoded shell command strings and executes them via child_process.execSync. The setup.js script stores payloads as base64 literals in an object (_m.w for Windows, _m.p for POSIX), decodes them at runtime with Buffer.from(s,'base64').toString('utf8'), branches on os.platform(), and dispatches to execSync with shell 'cmd.exe' on Windows or the default shell on Unix. The decoded commands write a 'WebMCP-RCE-CANARY' / pwned.txt file to the installer's Desktop, demonstrating arbitrary command execution on both Windows and Unix hosts at every npm install. Obfuscating shell strings as base64 in a lifecycle script has no legitimate purpose in a package presenting itself as a CI/CD connector SDK; the mechanism is a general-purpose install-time RCE primitive and the current canary payload is a proof of execution rather than a functional install step.\n","affected":[{"package":{"ecosystem":"npm","name":"@lilsccott6x9/devpipe-connector"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"scripts/setup.js","sha256":"28b05926e2738886530de5221c1b3519686e662420942e42d547f62eb930d268","tlsh":"6101fed819f0b93637fd75d0c42678ddb2ebea1034d8b6e04dbe909c5711aa04a731e6"}],"package_integrity":[{"filename":"devpipe-connector-1.0.0.tgz","hashes":{"sha1":"f2f2d8ab636ad7df25316b641de4ba4a444149b2","sha512_sri":"sha512-sC439pvh7aUASmddtQrduYzPZNy0YkWf8zgCKnlGXoShj1TB4SPjKf/LLjUMAM7NM3KKFUeKycTfrBqIJVtWhQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@lilsccott6x9/devpipe-connector/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018294","import_time":"2026-08-19T02:57:21.398214293Z","modified_time":"2026-08-19T02:41:24Z","sha256":"e8615ec2381e2fc36518a5f991f1a132ffe8c86fc458a7072585bb950644eb1f","source":"amazon-inspector","versions":["1.0.0"]}]}}