@wizloft/harness-plugin-repository-files

{"modified":"2026-08-19T08:33:51Z","published":"2026-08-19T08:33:51Z","schema_version":"1.7.4","id":"MAL-2026-14288","summary":"Malicious code in @wizloft/harness-plugin-repository-files (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d8197c156f5877fb7a024a3007bed2da30176f74960e3fa271cac4c4369f2705)\ndist/index.js of @wizloft/harness-plugin-repository-files ships a small legitimate wizloft-harness repository-files plugin followed at line 209 by a ~35KB obfuscator.io-packed IIFE (303-entry rotated string array _0x240a with decoder _0x4963, control-flow flattening, hex-named identifiers). Decoded strings in the appended segment include Ethereum JSON-RPC and block-explorer endpoints (drpc.org, publicnode.com, blockscout, an etherscan-style txlist/account API), a hardcoded mixed-case ETH address prefix 0xa322E5f3..., a forged Chrome User-Agent, brotli/gzip decompression, AbortController-based fetch, and a custom /0x/ls exfil path with x-payload-* headers. The payload runs at module load whenever a consumer imports the package and has no relationship to the advertised purpose of reading repository files for a harness runtime. Only the trailing segment is obfuscated; the legitimate plugin portion is plain ESM, indicating a hostile payload smuggled onto an otherwise-clean plugin build.\n","affected":[{"package":{"ecosystem":"npm","name":"@wizloft/harness-plugin-repository-files"},"versions":["0.1.1-alpha.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/index.js","sha256":"8899add5e17b506145541a191ca9f562a15ba24411ff7287275cbad49d9822dd","tlsh":"190395c567d0a41003076bbb771bb4e5e92a089e74884acbf11dfa84fba7326d5f1631"}],"package_integrity":[{"filename":"harness-plugin-repository-files-0.1.1-alpha.3.tgz","hashes":{"sha1":"2576a3539e0e38aba63b012c471477d75b03f236","sha512_sri":"sha512-JZNklTnTFooSUSfIS9AjuXmfPrqL/MAZr4biVGjEkrE3Vit5yYm3VjCEDLG8uSLbQlP3eUNPyZKPClnCzsbefA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@wizloft/harness-plugin-repository-files/v/0.1.1-alpha.3"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018412","import_time":"2026-08-19T08:48:53.928893395Z","modified_time":"2026-08-19T08:33:51Z","sha256":"d8197c156f5877fb7a024a3007bed2da30176f74960e3fa271cac4c4369f2705","source":"amazon-inspector","versions":["0.1.1-alpha.3"]}]}}