minequest

{"modified":"2026-08-19T07:35:07Z","published":"2026-08-19T07:35:07Z","schema_version":"1.7.4","id":"MAL-2026-14275","summary":"Malicious code in minequest (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (54dfa76784b35d5d63fa89a85c071e83d21e55291871b40627c36015291f24a1)\npackage.json declares a postinstall hook running scripts/init.js, which chmod 0755's assets/thanks-amd64.elf and execFileSync's it on Linux x64 during npm install. The README states the package has 'no install hooks, no native binaries — just readable JavaScript', and scripts/build-elf.js is written to look like a fully-auditable ~250-byte hand-assembled ELF that only prints a thank-you message. The binary actually shipped in the tarball is a 33,648,788-byte Go-compiled executable (sha256 05b696…4420) containing Go runtime symbols, chacha8, and references to /proc/self/cgroup, /proc/self/mountinfo, and syscall filter strings — an artifact with no relationship to the shipped build script. The documented audit path is a cover story for an opaque native binary that executes with installer privileges on every Linux x64 npm install, with no description of its actual behavior available to the installer.\n","affected":[{"package":{"ecosystem":"npm","name":"minequest"},"versions":["0.1.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"scripts/init.js","sha256":"5dc9bddadc1b3ffcf234cae29a91f516a4772e5dc2a04538e8e3274b7943474b","tlsh":"a011c29509e52330247582e5974720d69b5f8011a224ae65b4ec564b2f87a254363aff"},{"path":"scripts/build-elf.js","sha256":"355d6f00d992b1d9c92c1b807e17c4108ccf2ff1ec7577c0c58fba047d5cfc9f","tlsh":"65c1884502b52b74af2f68e26391d80bd4a4e18af610d244f99f23b51f87c2d91bcde7"}],"package_integrity":[{"filename":"minequest-0.1.1.tgz","hashes":{"sha1":"8602c793788b2a84343fbe04e5a44822fa6c7763","sha512_sri":"sha512-vduLTY4jlI3abL/pxHtRhZJYq5DEReTZB9+2SdAck8hXJb/SxNMeNBmmiHa7qjCmcs06hXQzmrJuJcYbjzNhmg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/minequest/v/0.1.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018391","import_time":"2026-08-19T07:48:47.075050132Z","modified_time":"2026-08-19T07:35:07Z","sha256":"54dfa76784b35d5d63fa89a85c071e83d21e55291871b40627c36015291f24a1","source":"amazon-inspector","versions":["0.1.1"]}]}}