check-error-util

{"modified":"2026-06-11T05:42:56Z","published":"2026-06-10T18:44:20Z","schema_version":"1.7.4","id":"MAL-2026-5527","summary":"Malicious code in check-error-util (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7c25cbbb904c18028cac363ba66eb89d91301bd3204a8347834e52387b4b575e)\nOn require/import, index.js executes a top-level resolveConfig() that reconstructs a URL from an XOR-obfuscated integer array, AES-256-CBC-decrypts it, fetches the URL over HTTPS, and runs the JSON `cookie` field of the response as JavaScript via `new Function('require', cookie)(require)`. This grants an attacker arbitrary Node code execution with full `require` access on any machine that loads the package. The URL is hidden behind a layered XOR + AES blob (getHashAddress → Buffer.from(...,'hex') → createDecipheriv('aes-256-cbc', key, iv)) with cover-story comments ('S-box substitution', 'address pipeline', 'service layer hydration') intended to evade static review — there is no legitimate reason for an error-comparison utility to ship encrypted remote URLs. The package also impersonates the legitimate chaijs `check-error` library: package.json copies the upstream author Jake Luer <jake@alogicalparadox.com>, the chaijs contributor list, and a repository URL pointing at chaijs/check-error, while the published name is `check-error-util` and the upstream loader code is absent from the real package.\n","affected":[{"package":{"ecosystem":"npm","name":"check-error-util"},"versions":["2.1.4","2.1.6","2.1.5","2.1.7","2.1.3","2.1.8"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"domains":["jsonkeeper.com"],"evidence_files":[{"path":"index.js","sha256":"1abef0e70c5337e9db4c53e70d3f28e2769448d0674f5a0b87c94bf005257f02","tlsh":"3cc1454673b9b26248bb94e1214bb46b5232b12f7079b1c5e28c44b16fc5d54ef32fd8"},{"path":"package.json","sha256":"5ec8c5e22f03394e453df05626182d3f7f208bd458a351dba1c5e1cbebd4eb2e","tlsh":"f12176a2ca664c532fd818a6ac4f1042b2608857ce94fc4c73aba10c9b6d12f02ff65c"}],"package_integrity":[{"filename":"check-error-util-2.1.4.tgz","hashes":{"sha1":"d54be74bd04ba6fce8d42da4b4b1fe877d3fa329","sha512_sri":"sha512-sJlHoqWv+wFgl31J8Q7MlfmD8Tyfd5YNx5ftbTSq8RC2EU5DP6w3tqSlkV7myLz0uE9N6XD+AMqF+BUjq5PdNw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/check-error-util/v/2.1.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/check-error-util/v/2.1.6"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/check-error-util/v/2.1.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/check-error-util/v/2.1.7"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/check-error-util/v/2.1.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/check-error-util/v/2.1.8"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","sha256":"4354c90de765b6812756121ed6ceb8784ca5a2d6e40f6aa97391e5014c35a038","import_time":"2026-06-10T19:23:48.994911165Z","id":"IN-MAL-2026-005298","modified_time":"2026-06-10T18:44:20Z","versions":["2.1.4"]},{"source":"amazon-inspector","sha256":"91cb4f3b95eca0a9d180e159ac28ce3cc697c771229f9447cd1a293ce9cff57d","import_time":"2026-06-10T19:23:49.056021617Z","id":"IN-MAL-2026-005299","modified_time":"2026-06-10T18:44:21Z","versions":["2.1.4"]},{"source":"amazon-inspector","sha256":"24cc0eadac07d953a8fb2335bb848dd379a08855a014e29c3766b3f56a36fd46","import_time":"2026-06-11T05:41:04.672235705Z","id":"IN-MAL-2026-005537","modified_time":"2026-06-11T05:03:39Z","versions":["2.1.6"]},{"source":"amazon-inspector","sha256":"39efbd4fb0ca7ceb96ef1b0b8852b3a01f063534aa884d9b41b9c0e9807e7342","import_time":"2026-06-11T05:41:04.576796101Z","id":"IN-MAL-2026-005536","modified_time":"2026-06-11T05:03:38Z","versions":["2.1.5"]},{"source":"amazon-inspector","sha256":"61a7e6a668d91a00d8a37aa73e538cf778fea022a19ba28e0c9d373a5946df05","import_time":"2026-06-11T05:41:04.921272413Z","id":"IN-MAL-2026-005539","modified_time":"2026-06-11T05:03:40Z","versions":["2.1.7"]},{"source":"amazon-inspector","sha256":"6836fe64dbf323ab80a8ac08c2c1a257f3402082d7bd05fc76c5c549defe67d3","import_time":"2026-06-11T05:41:05.034928196Z","id":"IN-MAL-2026-005540","modified_time":"2026-06-11T05:03:41Z","versions":["2.1.6"]},{"source":"amazon-inspector","sha256":"7c25cbbb904c18028cac363ba66eb89d91301bd3204a8347834e52387b4b575e","import_time":"2026-06-11T05:41:04.482931003Z","id":"IN-MAL-2026-005535","modified_time":"2026-06-11T05:03:38Z","versions":["2.1.7"]},{"source":"amazon-inspector","sha256":"e087c7abebf26095695a247b30a2ddda639f3c774ccda3cecbac7037fe454728","import_time":"2026-06-11T05:41:04.286605008Z","id":"IN-MAL-2026-005533","modified_time":"2026-06-11T05:03:37Z","versions":["2.1.3"]},{"source":"amazon-inspector","sha256":"3dbf726d1dec5d0add89d8c3499c5686f59d219140872b727a1813b170ef39d3","import_time":"2026-06-11T05:41:04.845825499Z","id":"IN-MAL-2026-005538","modified_time":"2026-06-11T05:03:40Z","versions":["2.1.5"]},{"source":"amazon-inspector","sha256":"64f3a618c56463b3da94d7ad2bfcd9f241ee3db8c6c7e8c49a82314dbfd860ad","import_time":"2026-06-11T05:41:05.13232345Z","id":"IN-MAL-2026-005541","modified_time":"2026-06-11T05:03:45Z","versions":["2.1.8"]},{"source":"amazon-inspector","sha256":"75e9f3a5c9df870e5f4f5accad4503ebaf5e542d183017e9ef79fddc3ecb942b","import_time":"2026-06-11T05:41:04.388272913Z","id":"IN-MAL-2026-005534","modified_time":"2026-06-11T05:03:37Z","versions":["2.1.3"]}]}}