mcq-session

{"modified":"2026-08-21T04:50:44Z","published":"2026-08-21T04:21:28Z","schema_version":"1.7.4","id":"MAL-2026-14347","summary":"Malicious code in mcq-session (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1acf694ae0258defc54c414980c5f8512b7055e69630ede15a8bfb37d2005b9b)\nOn any require()/import of mcq-session, the main module runs a top-level async IIFE that reads a file at../../../../public/logo.ico (a path escaping the package root into a host application's public assets), DES-decrypts the bytes with a hardcoded password 'bf497c0b9cee' using multiple CryptoJS decode formats, and pipes the decrypted plaintext into a detached, unref'd 'node' subprocess via stdin. The decrypted content is treated as executable JavaScript with no signature check, integrity verification, or user gate. The loader is disguised behind cover-story identifiers ('readLogoIco', 'ThetaSDK initialization'). The symmetric key ships alongside the loader, so the encryption serves only to defeat static inspection of the staged payload. The out-of-package path indicates the payload is dropped separately alongside a host application, making the on-disk blob attacker-controlled from the installer's perspective.\n","affected":[{"package":{"ecosystem":"npm","name":"mcq-session"},"versions":["1.0.4","1.0.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/api/session-api.js","sha256":"506388a1987e85f27591742a70b35b4ce54a8c5d3db48fb53e16a6807f1cdb1b","tlsh":"d4c1f15c2c03e12757f0e3bd4e32c454eb735a913b119aa1faac77a12f994d06532ed8"}],"package_integrity":[{"filename":"mcq-session-1.0.4.tgz","hashes":{"sha1":"243e9dc07bdd7e6f225f374dc14483dd00fe9dc6","sha512_sri":"sha512-kOEO+ILaWj6SwSgGMMlRjjiGtuEWlc3t9x+k0WefuvIg1CGJe4FxPkZuXY6t3Md+HQFC2FIk0ifCTMnY9dWhkg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/mcq-session/v/1.0.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/mcq-session/v/1.0.3"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018498","import_time":"2026-08-21T04:48:53.341858767Z","modified_time":"2026-08-21T04:21:28Z","sha256":"1acf694ae0258defc54c414980c5f8512b7055e69630ede15a8bfb37d2005b9b","source":"amazon-inspector","versions":["1.0.4"]},{"id":"IN-MAL-2026-018499","import_time":"2026-08-21T04:48:53.386731619Z","modified_time":"2026-08-21T04:21:37Z","sha256":"fe84a62bd4f46ea4176c612c777b12e5e0887596f69d69bfa91c2fcec43e08a6","source":"amazon-inspector","versions":["1.0.3"]}]}}