MAL-2026-10465

    Dashboard / Malicious Package / MAL-2026-10465

    MAL-2026-10465

    Published: 13 Jul 2026Last Modified: 13 Jul 2026

    Summary: Malicious code in node-sysmon-native (npm)

    Details: Source: amazon-inspector (612887c8528ff96b3bc3a61d678b6376099480c080d2d8a0960fe7798ac25f33) On module load, index.js reconstructs a hex-encoded URL (Buffer.from('687474703a2f2f3135322e35332e3132302e39302f636d64','hex')) that decodes to http://152.53.120.90/cmd and enters an asynchronous polling loop that GETs /commands from that host, executes each returned command via spawnSync('bash', ['-c', cmd]) with a 55-second timeout and 5MB output buffer, and POSTs the stdout, stderr, and exit code back to /results. Any consumer that require()s this package grants the operator of 152.53.120.90 arbitrary shell execution on the host, with output exfiltration. The destination is a bare IP address reconstructed at runtime from a hex string to hide it from static scanners, and the package's declared 'sysmon-native' purpose provides no legitimate reason for polling a hardcoded remote host for shell commands.

    References: https://www.npmjs.com/package/node-sysmon-native/v/1.0.0, https://www.npmjs.com/package/node-sysmon-native/v/1.0.1, https://www.npmjs.com/package/node-sysmon-native/v/1.0.2

    Affected packages

    Package

    Name: node-sysmon-native

    Purl: pkg:npm/node-sysmon-native

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    1.0.1
    1.0.2