caspian-day-js

{"modified":"2026-06-16T16:01:36Z","published":"2026-06-16T16:01:36Z","schema_version":"1.7.4","id":"MAL-2026-5892","summary":"Malicious code in caspian-day-js (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (895fe8e087ec7af36d61e8a6972f484e70bc1b828374ae83cef9ff4a927f7b55)\ncaspian-day-js impersonates the popular dayjs package: package.json copies author `iamkun`, homepage `day.js.org`, and repo `github.com/iamkun/dayjs.git`, and ships an unmodified `dayjs.min.js` as `main` so `require('caspian-day-js')` appears functional. The malicious payload is in the lifecycle hook: package.json declares `postinstall: node setup.cjs`. setup.cjs is heavily obfuscated (obfuscator.io-style string-array with a custom base64 decoder) and at install time sets `NODE_TLS_REJECT_UNAUTHORIZED='0'`, fetches a remote JavaScript payload, writes it to `<tmpdir>/<12-hex>.js`, then spawns `process.execPath` on the dropped file (detached, stdio:'ignore', windowsHide:true) with the C2 endpoint `23.254.164.123:443` passed as argv[1], and finally unlinks setup.cjs to erase traces. Every machine running `npm install caspian-day-js` executes attacker-controlled JavaScript with TLS verification disabled, contacting 23.254.164.123:443.\n","affected":[{"package":{"ecosystem":"npm","name":"caspian-day-js"},"versions":["1.11.23"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"setup.cjs","sha256":"944dc7fd9de2f2efcff6458501084324769f736053129c71db3bf8294478d5f5","tlsh":"4991935a2795ac95438947f3ae1530c6f95bcdae3c5d8083f214e770be3263492c1a33"},{"path":"package.json","sha256":"2a0438b85cb31f4090cc967b450ee89bde03fea62e409ebb39fbcfa82ed0514a","tlsh":"a851e035cd298d632ac441b974ac828255b0c9a34c56fc1c73aa534c8f6d62f20bdf2d"}],"package_integrity":[{"filename":"caspian-day-js-1.11.23.tgz","hashes":{"sha1":"f85f58e998be886224b6b2cf7f5f0c552fe0e75d","sha512_sri":"sha512-IPp7LDxRqjbY9uscGDk7oAGU5elYD+l3jsHL48Su90P+2U2Vm4pnslaLkt7dCX/xW9Dz61D7IOdD7FzwHvzjWg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/caspian-day-js/v/1.11.23"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-006769","import_time":"2026-06-16T16:06:34.873779401Z","modified_time":"2026-06-16T16:01:36Z","sha256":"895fe8e087ec7af36d61e8a6972f484e70bc1b828374ae83cef9ff4a927f7b55","source":"amazon-inspector","versions":["1.11.23"]}]}}