easydsbots

{"modified":"2026-08-19T06:28:27Z","published":"2026-08-19T06:28:27Z","schema_version":"1.7.4","id":"MAL-2026-14265","summary":"Malicious code in easydsbots (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6c3ee114e4ac67d2d02a9668c7ed0b38cbf62f9bc59e35b92c0ff9e713d3a688)\npackage.json declares `\"postinstall\": \"sudo node install.js\"`, escalating to root on `npm install`. install.js is heavily obfuscated (obfuscator.io: rotated 140-entry string array `a0_0xdc68`, hex-encoded property lookups, control-flow flattening, self-defending stubs) so the executed behavior is deliberately hidden from installers. index.js is similarly obfuscated (rotated 164-entry string array `a0_0x53d8`, runtime base64 decoding via `Buffer[...](ertrf,...).toString()`), declares `js-virtualizer` as a runtime dependency, and reads `process.env.INVOCATION_ID` into an `isRunningAsService` flag — an environment variable set only when a process is launched by systemd. The package also depends on `node-linux`, a library that registers /etc/init.d or systemd unit files. The combination — root-level lifecycle hook, opaque payload, systemd-context branch, and a daemon-installer dependency — is the shape of an obfuscated root-persistent daemon dropper executed at install time on the installer's host.\n","affected":[{"package":{"ecosystem":"npm","name":"easydsbots"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"5c7fb57281a7c9b072e73456826c3bc1eac9e6ededd6f4c47272fc0595a360b8","tlsh":"5de07d040c219b7325c199d85c23108bbf8b0714420884040397514453ed7bf04bf70a"},{"path":"index.js","sha256":"afd29f259cf6db93f45778b360d4552da1fc7aedea88869246039ec6e6e010bf","tlsh":"1303dec477c1f843228f4f737b16b6f5e12a4c9671c8248bf108bd98f9a9516e6a0db1"}],"package_integrity":[{"filename":"easydsbots-1.0.0.tgz","hashes":{"sha1":"65faab96a543a5acf2ee77aa5b28ee21002843be","sha512_sri":"sha512-hwjlUxKPc+EyzJObdBgSTkLdQpkeKIkQZk7OQLvFfFp6TTz0AemmpDHRmKSO1iu6YixKFfz28UZCVrBBfiIsZQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/easydsbots/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018382","import_time":"2026-08-19T06:49:44.442807323Z","modified_time":"2026-08-19T06:28:27Z","sha256":"6c3ee114e4ac67d2d02a9668c7ed0b38cbf62f9bc59e35b92c0ff9e713d3a688","source":"amazon-inspector","versions":["1.0.0"]}]}}