@worrisome/reutil

{"schema_version":"1.7.4","id":"MAL-2026-15604","published":"2026-08-26T14:55:09Z","modified":"2026-10-29T14:15:54.842120411Z","aliases":["GHSA-4f5p-mp5p-863f"],"summary":"Malicious code in @worrisome/reutil (npm)","details":"Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security (see reference). The package's only file is index.html, declared as the npm \"main\" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute at `npm install` time. index.html renders a fake Cloudflare Turnstile verification widget. An obfuscator.io-obfuscated inline script POSTs a hardcoded per-package \"hostKey\" to https://api.keyval.org/get, receives a base64-encoded IV:ciphertext pair, decrypts it client-side via the Web Crypto API (AES-CTR) using an embedded key to obtain a redirect URL, appends the visitor's original query-string parameters, and navigates the browser there via window.location.replace(). This \"dead drop\" design lets the operator change the phishing destination for every package sharing a hostKey without republishing to npm; OX Security observed keyval.org-served destinations including a typosquatted Microsoft login page and, at time of writing, a ChatGPT redirect. The package therefore does not attack the installing machine directly; it is used as a static file host on the npm CDN (e.g. unpkg/jsDelivr) so the index.html can be linked to and opened directly in a victim's browser as a phishing/ClickFix landing page. Published by npm user \"cattishly\" as part of a burst of near-identical single-purpose packages published between 2026-08-04 and 2026-08-24 that share this same fake-Turnstile-redirect page structure.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (eb0b278fa833e7d9d9b054a90f8b5454b7e8bb0a10c9dd1c3a3a0e452ccefa43)\nThe package's only shipped artifact is an index.html file that imitates a Cloudflare 'Just a moment...' challenge. The page fetches an AES-CTR-encrypted destination from https://api.keyval.org/get using a hardcoded key, decrypts it in the browser, and redirects via window.location.replace. There is no JavaScript module entry point, no require-able code, and no preinstall/install/postinstall/prepare lifecycle scripts in package.json. Installing or importing the package in a Node/npm context does not read installer secrets, fetch or execute remote code, or establish any network callback on the installer's machine. The abuse pattern is use of the npm registry as hosting for a browser-facing redirect/phishing landing page, which affects humans who open the HTML in a browser rather than developers who install the package as a dependency.\n\n## Source: ghsa-malware (ad22aa3768124294f33e5d03ae20c30c446154a102cd46e6ede7c6b3d58c7280)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"@worrisome/reutil","ecosystem":"npm"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.html","sha256":"d9b644fcc07e5fedfe787cdcf4efe5b1477f74c425148aac18c5bd242a6044e8","tlsh":"09625f5f74a311257a23a0bc2b6b67197174e007a50acc297fcd93488f4a4a9c9b7bcc"}],"package_integrity":[{"filename":"reutil-1.0.1.tgz","hashes":{"sha1":"9b7a7a014774bbe6a5d447105188d7255b7daf3b","sha512_sri":"sha512-8cBlgV3f+F3eLTQQrONXXAz1eieqyuZoyyphiSW9hmApFCh+h8OR8XaIKgIIPJr31jRCyasLn86+BHQgAfPusA=="}}]},"iocs":{"domains":["api.keyval.org"],"files":[{"digests":{"sha256":"f30a70e86f5aaf756b804cfbd337be56c785398e8b2bd1829bbbd680edae3f85"},"note":"Fake Cloudflare Turnstile page bundled as the package's main entry (from v1.0.3, the latest published version)","paths":["index.html"],"source":"PACKAGE_ARCHIVE"}]}}}],"references":[{"type":"WEB","url":"https://www.ox.security/blog/research-clickfix-phishing-npm-packages/"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@worrisome/reutil/v/1.0.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@worrisome/reutil/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@worrisome/reutil/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@worrisome/reutil/v/1.0.2"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-4f5p-mp5p-863f"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@worrisome/reutil/v/1.0.5"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019832","import_time":"2026-09-09T03:21:58.467812352Z","modified_time":"2026-09-09T02:52:31Z","sha256":"71b22071243e3b15f2851cb0146d99897ffd9e99c13e06e0af9f1efe5594a1a1","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-019831","import_time":"2026-09-09T03:21:58.376040745Z","modified_time":"2026-09-09T02:52:22Z","sha256":"ceac3153e46735eda039e1ae748bf401b54ef8410bc1cba49766518d05f8ab7b","source":"amazon-inspector","versions":["1.0.0"]},{"id":"IN-MAL-2026-019834","import_time":"2026-09-09T03:21:58.723975764Z","modified_time":"2026-09-09T02:52:53Z","sha256":"22f2441a1e150cd6616e3d1d284a8da9c8b612950af40bce2ee1c1c719e06f07","source":"amazon-inspector","versions":["1.0.3"]},{"id":"IN-MAL-2026-019833","import_time":"2026-09-09T03:21:58.558376624Z","modified_time":"2026-09-09T02:52:39Z","sha256":"4c40f89f1dea7ec516cac82fcaadf461d864572ba178873b15f4d5b48e9dc1ba","source":"amazon-inspector","versions":["1.0.2"]},{"id":"GHSA-4f5p-mp5p-863f","import_time":"2026-10-21T21:24:00.511552505Z","modified_time":"2026-10-21T21:20:34Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"ad22aa3768124294f33e5d03ae20c30c446154a102cd46e6ede7c6b3d58c7280","source":"ghsa-malware"},{"id":"IN-MAL-2026-022072","import_time":"2026-10-29T14:14:23.153591917Z","modified_time":"2026-10-29T13:45:06Z","sha256":"eb0b278fa833e7d9d9b054a90f8b5454b7e8bb0a10c9dd1c3a3a0e452ccefa43","source":"amazon-inspector","versions":["1.0.5"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OX Security","contact":["https://www.ox.security/"],"type":"FINDER"}]}