simple-node-calc-a

{"modified":"2026-06-25T07:26:28Z","published":"2026-06-25T07:26:28Z","schema_version":"1.7.4","id":"MAL-2026-6451","summary":"Malicious code in simple-node-calc-a (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f9a86d4aeac1d4f5fc458b3058f4b13229cd2097c9d8e5cf3e4d45aa24980ad8)\nsimple-node-calc-a@1.0.0 advertises itself as a pure-JS calculator but ships a binding.gyp that triggers node-gyp automatically during `npm install`. binding.gyp line 6 uses gyp's shell-expansion directive `\"<!(node lodash-compiler.js && echo stub.c)\"`, which executes the sibling file `lodash-compiler.js` in the installer's environment at configure time, before any user code runs. lodash-compiler.js is an 87 KB obfuscator.io-packed file (rotated 510-entry `_0x` string array, control-flow flattening, 2906 deobfuscation transforms) presented with a lodash custom-build banner but never declared as a dependency and never imported by index.js. The deobfuscated trailer resolves to `require('fs').writeFileSync('poc.txt', 'POC...')`, writing a file into the installer's current working directory outside the package's own folder. The combination — undocumented native-build hook in a package with no native code, heavily obfuscated payload reachable only via that hook, and a write to the installer's CWD — is a working install-time arbitrary-code-execution primitive. Today's payload drops a PoC marker file; the same channel can deliver any code the author chooses on subsequent versions.\n","affected":[{"package":{"ecosystem":"npm","name":"simple-node-calc-a"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"binding.gyp","sha256":"65909a4a51885d65e952c363a079f27e8ea7730f7dde834241532c9b9b6940e4","tlsh":"eec08c3cda2c4d5026c6156cc36ac543ec20c293c88a6d44b68d15bc8f651072c6d5ee"},{"path":"lodash-compiler.js","sha256":"f704c05585e1ab123374cbb5400aa1199829e197eb9696d6ed841539ce553147","tlsh":"d383634866c0ecd433874f7a7baf70e5fa7e09d97584091ec51afc90a8e0a06f9e1971"}],"package_integrity":[{"filename":"simple-node-calc-a-1.0.0.tgz","hashes":{"sha1":"f7a8413fe217a2465f5c9d1ada0f9d2df6eb20c6","sha512_sri":"sha512-N2hKHxlwW9phs0IbAonvjaVUzUz9Zzc2XXbUj4ioQk289SPotssG9V5zYpTDkMDRET2Ot7RAF9KFgbuz5wVxhw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/simple-node-calc-a/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-007505","import_time":"2026-06-25T07:47:52.631452343Z","modified_time":"2026-06-25T07:26:28Z","sha256":"f9a86d4aeac1d4f5fc458b3058f4b13229cd2097c9d8e5cf3e4d45aa24980ad8","source":"amazon-inspector","versions":["1.0.0"]}]}}