anhn-cli

{"modified":"2026-08-19T08:37:09Z","published":"2026-08-19T08:37:09Z","schema_version":"1.7.4","id":"MAL-2026-14290","summary":"Malicious code in anhn-cli (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7b0f11f74231c27bd3e3ac41dea5290466f042224f64547d88a328d6b87cf657)\nbin/install/install.js appends a heavily obfuscated top-level IIFE (obfuscator.io-style rotated string array `_0x240a`/`_0x4963` with arithmetic index decoding) after the benign install() helper. The payload queries public Ethereum RPCs and etherscan.io for transactions from the hardcoded sender address 0xa322E5f3..., decodes the transaction `to` field as an IPv4 address, fetches an XOR-encrypted body from that host, and executes it via `eval(prefix+xor(body))` and a detached `spawn('node', ['-e',...], {detached:true}).unref()`. The package's main entry (bin/index.js) unconditionally requires./install/install, so the IIFE runs whenever the package is required or the CLI is invoked. The attacker controls the fetched payload by publishing new Ethereum transactions from the sender address; there is no version pinning, no signature check, and the destination host rotates on-chain. Decoded strings inside the string array include `eth_getBlockByNumber`, `etherscan.io`, `eval`, and `spawn`.\n","affected":[{"package":{"ecosystem":"npm","name":"anhn-cli"},"versions":["1.1.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"bin/install/install.js","sha256":"edd592deaa4eb1924b0eeaee130c299c39b7d6617e515432037206b75296aacd","tlsh":"08e23284a7d0a440034b6abbbb1bf4e5e96a0cac75844ac7f11dbd84f766327e4f1531"}],"package_integrity":[{"filename":"anhn-cli-1.1.4.tgz","hashes":{"sha1":"93dac554ac1d931f434c3786f202b1522f42c703","sha512_sri":"sha512-KYigpzpMwqd5ehpwRrIA4K34sZd/md0hak//yjK3nhQeE+LivicgeeXKJ210JFBwoK3RLxHofeCnhefmzztksA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/anhn-cli/v/1.1.4"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018413","import_time":"2026-08-19T08:48:53.993969046Z","modified_time":"2026-08-19T08:37:09Z","sha256":"7b0f11f74231c27bd3e3ac41dea5290466f042224f64547d88a328d6b87cf657","source":"amazon-inspector","versions":["1.1.4"]}]}}