@sarex-team/viewer

{"modified":"2026-08-19T02:31:51Z","published":"2026-08-19T02:31:51Z","schema_version":"1.7.4","id":"MAL-2026-14207","summary":"Malicious code in @sarex-team/viewer (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (04b67de30d08d48f32be517383d6940c8179d2269ea7a1720346eacc2e8c28d5)\nThe package runs a DNS-based beacon that leaks the installer's OS username, hostname, and current-working-directory basename to the hardcoded attacker-controlled domain oob.sl4x0.xyz. lib/core.js collects os.userInfo().username, os.hostname(), and process.cwd(), joins them as subdomain labels under oob.sl4x0.xyz, and issues a dns.resolve4() lookup so the encoded values are exfiltrated via DNS. The destination domain and the module/API names ('os', 'dns', 'process', 'userInfo', 'hostname', 'cwd', 'resolve4') are reconstructed from numeric char-code arrays in lib/b02e30.js and lib/6ad264.js solely to conceal them. Execution is zero-interaction: package.json declares scripts.install: 'node index.js', and index.js top-level requires./lib/core inside a try/catch that swallows errors, so the beacon fires on npm install and again on every require() of the package while the install appears clean.\n","affected":[{"package":{"ecosystem":"npm","name":"@sarex-team/viewer"},"versions":["9.9.11"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/core.js","sha256":"397d1435e7291ed6b02b8627033a110124d250a54290b3a8f9f248573fd6a2d4","tlsh":"38014929a393c08f97e096d0361a03d18499c380e7ce80a5fa7c4a87904e7d1cac5a96"},{"path":"lib/b02e30.js","sha256":"c72f0886badea13eb11e8d42e4b57eede2defdfd8a64cd27bf082871860d9445","tlsh":"2de068173303c94fa1880bfb7e0050a0aa4d8b58a25dc0d6b628678500af843d0c0632"},{"path":"package.json","sha256":"ae38c8cd9835f7be563c4b1d2729b5dc331e948d378fdb05e39aaf059b72e4b9","tlsh":"0b21ad25dd254c232ec82990ec692942f46208174d847c0573d6513c8f9f6af91ff21e"}],"package_integrity":[{"filename":"viewer-9.9.11.tgz","hashes":{"sha1":"2a727369307a595a3347be8d2be17df2d1e9690d","sha512_sri":"sha512-85k1DzM0tPQ9zJ89/D9pMvyZIV6HHNuSDsYzPH78STmvqwUvvStCerruroS4QWii0RPdl9LlARNNMu6tKcEp+A=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@sarex-team/viewer/v/9.9.11"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018293","import_time":"2026-08-19T02:57:21.293755533Z","modified_time":"2026-08-19T02:31:51Z","sha256":"04b67de30d08d48f32be517383d6940c8179d2269ea7a1720346eacc2e8c28d5","source":"amazon-inspector","versions":["9.9.11"]}]}}