@prime0/alanced-match

{"modified":"2026-09-16T06:27:22Z","published":"2026-09-16T06:27:22Z","schema_version":"1.7.4","id":"MAL-2026-16204","summary":"Malicious code in @prime0/alanced-match (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (53d49bf28eb233bca0591b32c11b411d1c10b8e8f978d1b76c6df2e6a00772f3)\nThe package @prime0/alanced-match is a 1-character-drop typosquat of balanced-match. Its postinstall.js runs automatically on npm install and POSTs a host fingerprint (hostname, username, platform, arch, cwd, node version, pid, non-internal IP addresses, uptime, package name) to the hardcoded bare-IP endpoint http://69.48.229.140:8080/b. Its main entry index.js opens a require-time HTTP polling channel to the same host, retrieves JSON commands from /c every 30 seconds (with 10-minute re-beacons), executes them via child_process.exec, and posts stdout/stderr back to /r — providing full remote code execution on the installer's machine. A source comment self-identifies the code as a 'Minimal stealth agent' and 'typosquat'.\n","affected":[{"package":{"ecosystem":"npm","name":"@prime0/alanced-match"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"a7fc4e3167420ca41e89f929a9721a63761e20c83b555338d91580d46e3dd3f1","tlsh":"ff4142eb91952124a17371f4ca5f64082bbad16202439e98bc2ce385af7493c072adfc"},{"path":"postinstall.js","sha256":"f96920db8aa0d72723e7eab7dc5319f4395a201f8eba307b4f81974730c1d75c","tlsh":"571165e00191a6293222a1f1ca5f150917e9e4101201fe98f83cd285bff4e7c07f69ec"}],"package_integrity":[{"filename":"alanced-match-1.0.0.tgz","hashes":{"sha1":"ca2231abea3bb4cad9786e92ccc5a8002df72719","sha512_sri":"sha512-g2qPbOPJmote+Y1VNxEYt28dxGPldP4MczXopsf4P4KnNOfLYHbl371tjPY0dkMnaC0VziO8mHcatiGPLTazgQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@prime0/alanced-match/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020072","import_time":"2026-09-16T06:31:14.372842728Z","modified_time":"2026-09-16T06:27:22Z","sha256":"53d49bf28eb233bca0591b32c11b411d1c10b8e8f978d1b76c6df2e6a00772f3","source":"amazon-inspector","versions":["1.0.0"]}]}}