@asenfotech/unplugin-element-plus

{"modified":"2026-09-21T03:47:58Z","published":"2026-09-21T03:31:05Z","schema_version":"1.7.4","id":"MAL-2026-16318","summary":"Malicious code in @asenfotech/unplugin-element-plus (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (458bff9dc8d1f808d642b767ca08ca89253919bbf0d7fd2890b95f3b9c156926)\nPackage presents itself as an Element Plus resolver for Vue tooling: index.js is a 25-line ElementPlusResolver stub. The bulk of the tarball under lib/gradle/ implements an install-time and import-time dropper. The declared postinstall hook (postinstall-run.cjs) chains through lifecycle/instrumentation modules that assemble ~90 base64 chunks in agent-bytecode.segments.cjs, decode them via Buffer.from(joined, 'base64'), write the result to ~/.gradle/caches/transforms-3/8.7/instrumented/.../instrumentation-agent-runtime.mjs (a path masquerading as a Gradle instrumentation cache), and spawn a detached, hidden node process on it (spawn(nodeBin, [scriptPath,...], { detached: true, stdio: 'ignore', windowsHide: true }); child.unref()). The decoded payload is a full command-and-control agent: it POSTs hostname, username, and OS type/release plus a persisted agent UUID (~/.gradle-cache/.aid) to https://npmjs.it.com/api/register (a typosquat of npmjs.com), long-polls https://npmjs.it.com/api/task/<id>, and executes operator commands including exec (spawns /bin/sh or cmd.exe with attacker-supplied command), ls, download (POSTs arbitrary local file contents to /api/file/<agent>/<task>), upload (writes attacker-supplied bytes to the filesystem), delete, ps, and move; results are POSTed back to the same host. TLS verification for C2 traffic can be disabled via C2_TLS_INSECURE. The package's main entry re-triggers the same drop-and-launch chain on require() through tooling-bootstrap.cjs and lib/gradle/gradle-daemon-sync.cjs, gated on a hardcoded workspace-marker allowlist (src/pages/GameAggregator/GameAggrBusinessPage/index.tsx, src/master/src/router/routes.tsx, etc.), so the backdoor also fires at import time inside a specific targeted monorepo. The gradle/instrumentation directory naming has no relation to the declared Vue-resolver purpose and pairs with the chunked-base64 encoding to conceal the payload.\n","affected":[{"package":{"ecosystem":"npm","name":"@asenfotech/unplugin-element-plus"},"versions":["2.9.5","2.9.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/gradle/runtime-launcher.cjs","sha256":"01c13a519819855b75508ac02c58a2c11d02bacdb06f86840cb662a190640f25","tlsh":"0f3132ca55f6227543d2015dd66f945bb647c143230dc8d0fafcc2c16fa672882729e9"},{"path":"lib/gradle/instrumentation/agent-bytecode.segments.cjs","sha256":"825217e2465693951ea8b51519a4b7bf7aa3c58fae80c8b2a9884ac81e435e6b","tlsh":"b6324ea6cc8f1d4453644906a9cd29c9188e07876dd23acdb3af82dc9b4e46f15f81ed"},{"path":"lib/gradle/instrumentation/decode-pipeline.cjs","sha256":"5e07d23013be1ae653611d52d465dc7de7c20d7d43ae24659ea7fcbde7050c50","tlsh":"b5e061ca29f0b10d03015cfb408bdc97719dc5273249dc91257876de7764fb891b68d8"},{"path":"lib/gradle/workspace-layout-probe.cjs","sha256":"92d2d05625f7516549b7e95e9bcf19f7fc7092b32cc5e1e3ccfafb2ef52e90e3","tlsh":"8b315790b1d337265cb3fb98f51e0404f5dec5a562049d12ba9d7ac13f439342271adc"},{"path":"package.json","sha256":"8f7043c50a289e666e57d0dd73195a10c8797507c039e4801aeb2c7038c2acb4","tlsh":"11012251d0681e7240f96aa90467a48f103007838849fd2832f7015c6f9f36b24ff5af"}],"package_integrity":[{"filename":"unplugin-element-plus-2.9.5.tgz","hashes":{"sha1":"9088281859da20d16dfc8352b10f8c771882c98c","sha512_sri":"sha512-Bce9H6AlKoKgMsQoIzdQZrwsDwAoNz32j9YA4tXjOGH4rrzY/zAwEU3BGN7Wt+zUxVwgZsti2JMznYDwX2Bofw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@asenfotech/unplugin-element-plus/v/2.9.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@asenfotech/unplugin-element-plus/v/2.9.3"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020232","import_time":"2026-09-21T03:46:38.242696488Z","modified_time":"2026-09-21T03:31:05Z","sha256":"458bff9dc8d1f808d642b767ca08ca89253919bbf0d7fd2890b95f3b9c156926","source":"amazon-inspector","versions":["2.9.5"]},{"id":"IN-MAL-2026-020233","import_time":"2026-09-21T03:46:38.32158153Z","modified_time":"2026-09-21T03:31:14Z","sha256":"dae3cff962abf527491a770319bc68e5a44f31d16c1481e22d395cd1f83ffbf3","source":"amazon-inspector","versions":["2.9.3"]}]}}