zenith-utils

{"modified":"2026-06-24T18:42:36Z","published":"2026-06-24T18:05:07Z","schema_version":"1.7.4","id":"MAL-2026-6401","summary":"Malicious code in zenith-utils (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c29676376a28531b186e09fbf7e2d3a0697943ece764e0604ebbdd4b734ae094)\nPackage name is zenith-utils but the tarball is a verbatim copy of the nodemailer source tree (lib/nodemailer.js as main, lib/smtp-transport, lib/ses-transport, lib/dkim, lib/mail-composer, etc.; package.json author set to nodemailer's real maintainer 'Andris Reinman'). package.json declares `postinstall: node lib/utils/index.js`, which uses spawn with `detached: true`, `stdio: ['ignore','ignore','ignore']`, and `child.unref()` to launch lib/utils/smtp-connection/index.js as a hidden background process that survives the npm install command. That process forks lib/utils/smtp-connection/worker.js, which polls `https://jsonkeeper.com/b/WDH3V` in an infinite loop and executes the returned `cookie` field via `new Function('require', r.data.cookie)(require)`. jsonkeeper.com is an anonymous, mutable paste host — the author can change the served payload at any time, granting arbitrary Node-privileged code execution on every machine that has installed the package. The detached/unref'd spawn is deliberately designed to hide the activity from npm's lifecycle logs while the eval loop runs persistently in the background.\n","affected":[{"package":{"ecosystem":"npm","name":"zenith-utils"},"versions":["12.0.14","12.0.15"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/utils/smtp-connection/index.js","sha256":"f94135cbe8ec654951d9482c17411d4161390492c181be55c5add2e0f673a606","tlsh":"e9e0686327e4602e213615f2e79e20227007c1636a9afcd9b3c88bb256d2ed11d12ef4"},{"path":"lib/utils/smtp-connection/parse.js","sha256":"4aac106a4f36aba6433c7ded453d724307ee55616e240883cd46204549cf24b1","tlsh":"7cf0a6802cb8fb900345b0e7c0bbeb07a198a068312287a48a8f9d5a45868488a130dd"}],"package_integrity":[{"filename":"zenith-utils-12.0.14.tgz","hashes":{"sha1":"dabb64ce9ff8824c76e3bf497652e379c8fe4a0d","sha512_sri":"sha512-lF3G1vx+NnYo7cLWtRJUUL+S9gqDPd0knoOTk8/Al7ifnnME1H2QuCLR4dR18o6nxVZ8GuT4Wkqg8mGU1UWQLw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/zenith-utils/v/12.0.14"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/zenith-utils/v/12.0.15"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-007442","import_time":"2026-06-24T18:41:01.057182649Z","modified_time":"2026-06-24T18:05:12Z","sha256":"93912585a6536fdb12c8341a2a896f3c51943f70f74a0fdd45b0c4c76030ab2e","source":"amazon-inspector","versions":["12.0.14"]},{"id":"IN-MAL-2026-007441","import_time":"2026-06-24T18:41:01.01892Z","modified_time":"2026-06-24T18:05:07Z","sha256":"c29676376a28531b186e09fbf7e2d3a0697943ece764e0604ebbdd4b734ae094","source":"amazon-inspector","versions":["12.0.15"]}]}}