MAL-2025-6214

Dashboard / Malicious Package / MAL-2025-6214

MAL-2025-6214

Summary: Malicious code in ecinc-cloud-moaxmpp (npm)

Details: Package exhibits multiple malicious behaviors: Office doc access/encryption, DB interaction, local storage clearing, arbitrary code execution, /dev/shm ref. The code includes a native bridge that allows it to execute arbitrary SQL queries on a mobile device’s database when used within a specific mobile application context. The `ecmoaxmpp.umd.js` file revealed a highly suspicious pattern. The code includes a function that checks if `window.mappType` is not equal to `'web'`. When this condition is met, it proceeds to call `window.$wv.databaseHandle`, a function that acts as a bridge to a native mobile application. The methods invoked through this bridge include 'execute', 'rawQuery', 'rawInsert', 'rawUpdate', and 'rawDelete', all of which indicate direct, raw access to a mobile device’s database. Source: amazon-inspector (278b09ddb42295dff2bd8c843131f7f3c9d4d793bb42dd797adbc9c6c825a656) The package was found to contain malicious code or consuming dependency that contains malicious code

References: https://platform.safedep.io/community/malysis/01K01T6C4JN4Q19HD1PAB151RZ, https://www.npmjs.com/package/ecinc-cloud-moaxmpp/v/9.7.1, https://www.npmjs.com/package/ecinc-cloud-moaxmpp/v/9.7.2