js-soul

{"modified":"2026-08-25T07:08:58Z","published":"2026-08-25T07:08:58Z","schema_version":"1.7.4","id":"MAL-2026-14477","summary":"Malicious code in js-soul (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3e5bb2e2d2011a8e8bcc3c0fba8aeed7cca1e1b92e19ea867535a27dbf2cc500)\nOn module load, src/api/session-api.js reads../../../../public/logo.ico (a path outside the package), DES-decrypts the contents with the hardcoded key 'bf497c0b9cee', spawns a detached `node` child process via child_process.spawn with {detached:true}, and pipes the decrypted plaintext into the interpreter's stdin, executing arbitrary code at `import 'js-soul'`. The disguise of executable JavaScript as an image asset, the hardcoded DES key, and an unrelated 'ThetaSDK initialization error' catch-block string contradict the package's stated purpose as a session helper library and its README claim that nothing runs on import. Any code the attacker stages at the sibling path executes in the installer process with the installer's privileges.\n","affected":[{"package":{"ecosystem":"npm","name":"js-soul"},"versions":["1.0.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/api/session-api.js","sha256":"506388a1987e85f27591742a70b35b4ce54a8c5d3db48fb53e16a6807f1cdb1b","tlsh":"d4c1f15c2c03e12757f0e3bd4e32c454eb735a913b119aa1faac77a12f994d06532ed8"}],"package_integrity":[{"filename":"js-soul-1.0.4.tgz","hashes":{"sha1":"fe317845ae644a49db94f0880b3940e88ff89ed2","sha512_sri":"sha512-0X5Sm6XN2H5ZFsg46If5C8dp5dBkmDQtlRbWBpsFxV+wnBBltTNM4SG6uUofIHgAqYM+5uVavOJ2jP0CKezz0w=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/js-soul/v/1.0.4"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018694","import_time":"2026-08-25T07:23:45.307696656Z","modified_time":"2026-08-25T07:08:58Z","sha256":"3e5bb2e2d2011a8e8bcc3c0fba8aeed7cca1e1b92e19ea867535a27dbf2cc500","source":"amazon-inspector","versions":["1.0.4"]}]}}