@sarex-team/sdk-js

{"modified":"2026-08-19T02:31:33Z","published":"2026-08-19T02:31:33Z","schema_version":"1.7.4","id":"MAL-2026-14204","summary":"Malicious code in @sarex-team/sdk-js (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3b599c4cb22f02d79a217a53a61243a08017783b2a8d41afaa59b46128d863c2)\nPackage declares scripts.install=\"node index.js\", which top-level requires lib/core.js. lib/core.js reads os.userInfo().username, os.hostname(), and process.cwd(), joins them with a package tag and timestamp, and issues dns.resolve4() against a subdomain of oob.sl4x0.xyz — a DNS-tunneled beacon to an attacker-controlled out-of-band collector. The destination host oob.sl4x0.xyz and the Node API names (os, dns, userInfo, hostname, cwd, resolve4) are stored as hex byte arrays in lib/b02e30.js and lib/6ad264.js and reconstructed at runtime via String.fromCharCode to disguise the recon path. The beacon fires automatically on npm install and again on every require() of the package, with no user interaction required.\n","affected":[{"package":{"ecosystem":"npm","name":"@sarex-team/sdk-js"},"versions":["9.9.11"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/core.js","sha256":"397d1435e7291ed6b02b8627033a110124d250a54290b3a8f9f248573fd6a2d4","tlsh":"38014929a393c08f97e096d0361a03d18499c380e7ce80a5fa7c4a87904e7d1cac5a96"},{"path":"lib/b02e30.js","sha256":"901819b610885da0d093f873f1b55205aa448ca4741c4ef5de0300b3ad1a5d55","tlsh":"9de068073303c94fa1880bfb7d0050a0aa0e8b58a21dc0eab528678900af443c0c0632"},{"path":"package.json","sha256":"8f978b11e45f51711f1469342d36bfad446e8154e4bbd4d4c20649aae7d401df","tlsh":"1d216a21de654c232ec82994ec692942f56248174d417c0973d6923ccfaf6af51ff61e"}],"package_integrity":[{"filename":"sdk-js-9.9.11.tgz","hashes":{"sha1":"2728031f8f6dab9f1e16f0419f59071cc7087e2e","sha512_sri":"sha512-spwOOv0rZEaGd2IsO4BGrdgzl4RlRGTe7NLygdbK6NIvev8ghVVKVXZP0Zzs5HauWbc5PyOARGf+VT3gA7HnXA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@sarex-team/sdk-js/v/9.9.11"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018291","import_time":"2026-08-19T02:57:20.904137811Z","modified_time":"2026-08-19T02:31:33Z","sha256":"3b599c4cb22f02d79a217a53a61243a08017783b2a8d41afaa59b46128d863c2","source":"amazon-inspector","versions":["9.9.11"]}]}}