yian666aikf

{"modified":"2026-06-20T03:50:32Z","published":"2026-06-20T03:50:32Z","schema_version":"1.7.4","id":"MAL-2026-6234","summary":"Malicious code in yian666aikf (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f96776bdaabacae768376d5c1ff3543f77d94b41298d3d01365032817c3cd53e)\nyian666aikf@1.0.3 advertises itself as a lightweight string-manipulation utility library, but its only on-install effect is to launch a reverse shell. package.json registers a postinstall hook (scripts/postinstall.js) that spawns scripts/shell.js as a detached, stdio-ignored, windowsHide background process via process.execPath. shell.js opens a TCP socket to 114.67.90.67:4444 and pipes an interactive shell through it — /bin/sh -i on Unix, powershell on Windows — with a 10-second auto-reconnect loop. The shipped index.js exposes benign string helpers (capitalize/truncate/etc.) that never reference the scripts/ directory; the utility surface is a decoy for the backdoor delivered on `npm install`. Any developer or CI runner installing this package immediately hands an interactive shell on their host to the attacker at 114.67.90.67:4444, with persistence via the reconnect loop.\n","affected":[{"package":{"ecosystem":"npm","name":"yian666aikf"},"versions":["1.0.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"scripts/shell.js","sha256":"026bd41bf57b7a84a8cad7e0b1455d2d50ca535458cecc6955981fcb52266eb7","tlsh":"b911029551b5813b03bb8875899bc4323137d2137717e3c433dd105d9f838a81e9a5f4"},{"path":"package.json","sha256":"99baecd8c5609ddeac42660693a6161efb76d26a5dd8ff7a114c429910c8fe6f","tlsh":"f5f04c28cf205d3319e91a566da9644ab171580b0944bc183bd3801c5fae7af54ff31d"}],"package_integrity":[{"filename":"yian666aikf-1.0.3.tgz","hashes":{"sha1":"1bd78a062cf4d617d518bf139a285babc4a8aed6","sha512_sri":"sha512-tK2SexTYv4fFP+I6o3a+/oiOHwYLhLrZJnKXuSbMFPaL/J7P7Xbpv4VHbayfqbSwQf+ddCCXClg8pxsMliWcjw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/yian666aikf/v/1.0.3"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-007093","import_time":"2026-06-20T04:58:37.606905029Z","modified_time":"2026-06-20T03:50:32Z","sha256":"f96776bdaabacae768376d5c1ff3543f77d94b41298d3d01365032817c3cd53e","source":"amazon-inspector","versions":["1.0.3"]}]}}