MAL-2026-11130

    Dashboard / Malicious Package / MAL-2026-11130

    MAL-2026-11130

    Published: 28 Jul 2026Last Modified: 28 Jul 2026

    Summary: Malicious code in array-node-utils (npm)

    Details: Source: amazon-inspector (c0dbd4ffa55ee3a0972b3e5e3fef599244049244d9f996a9d8b809a3a3a53e1a) The package's main file index.js is a heavily obfuscated (obfuscator.io RC4+base64 string-array) module whose top-level IIFE runs on require(). It loads https, path, os, fs, child_process, and crypto; assembles a 4-octet host string via repeated.concat calls to hide the destination; issues an https GET; pipes the response through crypto.createDecipheriv (AES) with a sha256-derived key; writes the decrypted bytes to a file under os.tmpdir(); and executes that file via child_process with windowsHide and cwd set to the user's home directory. The package's declared purpose ('array-node-utils') has no relationship to the shipped code — the module contains no array-handling logic, only the fetch-decrypt-exec chain.

    References: https://www.npmjs.com/package/array-node-utils/v/1.0.9

    Affected packages

    Package

    Name: array-node-utils

    Purl: pkg:npm/array-node-utils

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.9
    MAL-2026-11130 | CVE-DB