@sarex-team/translator

{"modified":"2026-08-19T02:31:24Z","published":"2026-08-19T02:31:24Z","schema_version":"1.7.4","id":"MAL-2026-14205","summary":"Malicious code in @sarex-team/translator (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0bccb8e95706f8ed3fe0408d43f6e043f6db71126f1951dda76bda7dfcc134e6)\nThe package's install lifecycle script (scripts.install=\"node index.js\") automatically executes on npm install and loads lib/core.js. That module reads os.userInfo().username, os.hostname(), and the basename of process.cwd(), concatenates them with a timestamp as subdomain labels, and issues a dns.resolve4 lookup against oob.sl4x0.xyz — encoding the installer's identity into a DNS query that reaches the attacker's authoritative nameserver. The destination domain, the module names ('os', 'dns', 'process'), and the accessor names ('userInfo', 'hostname', 'cwd') are reconstructed at runtime from char-code arrays in hex-named files (lib/b02e30.js, lib/6ad264.js), concealing the exfiltration path from casual review. The exfil domain sl4x0.xyz matches the package author's contact email (research@sl4x0.xyz), confirming the destination is author-controlled.\n","affected":[{"package":{"ecosystem":"npm","name":"@sarex-team/translator"},"versions":["9.9.11"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/core.js","sha256":"397d1435e7291ed6b02b8627033a110124d250a54290b3a8f9f248573fd6a2d4","tlsh":"38014929a393c08f97e096d0361a03d18499c380e7ce80a5fa7c4a87904e7d1cac5a96"},{"path":"lib/b02e30.js","sha256":"17a31d36ceec65eebee4cfb6feeea9d7a9b79750f8279172692d70d25a7863a8","tlsh":"1ee068073313c94fa1880bfb7e0050a0aa1d8b58a21dc0d6f628678600af447d0c0632"}],"package_integrity":[{"filename":"translator-9.9.11.tgz","hashes":{"sha1":"4872ede38a3aea80b1a44a6fab4b3b8be5c5b3b8","sha512_sri":"sha512-vybHHXNG4gKoQm4WkjJBob0e7O92Fnn0XoUHXx7h4dKImFl0G7so1BlEPs//zxuPNzpb77P059VHEQfmmWWA0Q=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@sarex-team/translator/v/9.9.11"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018290","import_time":"2026-08-19T02:57:20.777786174Z","modified_time":"2026-08-19T02:31:24Z","sha256":"0bccb8e95706f8ed3fe0408d43f6e043f6db71126f1951dda76bda7dfcc134e6","source":"amazon-inspector","versions":["9.9.11"]}]}}