license-checker-plus

{"modified":"2026-05-26T13:23:35Z","published":"2026-05-24T02:47:18Z","schema_version":"1.7.4","id":"MAL-2026-4599","aliases":["GHSA-73xx-w222-rg6v"],"summary":"Malicious code in license-checker-plus (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (66ac93280c5fc72f65d15486a69369e4d2c2b289fa6f062a6643b63137fc6aa9)\nPackage name mimics the widely-used `license-checker` while shipping an undocumented `lib/compliance.js` module that harvests credentials. The module scans `process.env` for keys matching `/KEY|PRIVATE|MNEMONIC|DEPLOYER|SECRET|TOKEN|PASSWORD|CREDENTIAL|AWS_/i`, AES-256-GCM-encrypts the collected entries with a key derived from `sha256('lc:' + COMPLIANCE_SERVICE)`, and POSTs the ciphertext (carried via an `X-Project-Id` header and JSON body) to `https://licenses.rpc-health-monitor.xyz/v1/compliance` (lib/compliance.js:7, 32-33, 39, 101). The MNEMONIC/DEPLOYER keywords indicate crypto-wallet credential targeting. Repository metadata is inconsistent: `bugs.url` still references the legitimate davglass/license-checker repo while the package is published from a freshly-created GitHub account, and the README is copied from the original with no mention of a 'compliance' feature. The encrypt-before-send design is intended to evade network inspection. While the exfiltration call is not yet reached from the documented entry point in this version, the harvester is fully wired (key derivation, encryption, POST channel) and the package is a clear typosquat lure — installer harm is the package's purpose.\n\n## Source: ghsa-malware (b45e61e83915331b1d95eed997d2c039f6627838f639bbdde6b71ef4989da9a8)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"ecosystem":"npm","name":"license-checker-plus"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["26.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/compliance.js","sha256":"bc867ba512443236318846c5b8c7c3a77bfde94f7a635ca8c97721b7e2ca49a4","tlsh":"0e81626859fb20910af3b599976fd18abdbbc603450ddd50b99c96500f8443c06eedf8"}],"package_integrity":[{"filename":"license-checker-plus-26.0.0.tgz","hashes":{"sha1":"55ddf6436ebd9d7897fd878173c186c94e1beb94","sha512_sri":"sha512-xP0umiS3tFoJP1Jgc4b+o3vK4uS1G5yikbasixRepkIHKhEta7FbAc9waE7h+EVSK2Q9LL7z+KpHd4D7BImN0A=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/license-checker-plus/v/26.0.0"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-73xx-w222-rg6v"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["actran@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","sha256":"66ac93280c5fc72f65d15486a69369e4d2c2b289fa6f062a6643b63137fc6aa9","import_time":"2026-05-26T05:52:37.652004721Z","id":"IN-MAL-2026-004452","modified_time":"2026-05-24T02:47:18Z","versions":["26.0.0"]},{"source":"ghsa-malware","sha256":"b45e61e83915331b1d95eed997d2c039f6627838f639bbdde6b71ef4989da9a8","import_time":"2026-05-26T13:21:46.723004148Z","id":"GHSA-73xx-w222-rg6v","modified_time":"2026-05-26T11:56:00Z","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]}]}}