MAL-2026-11539

    Dashboard / Malicious Package / MAL-2026-11539

    MAL-2026-11539

    Published: 4 Aug 2026Last Modified: 4 Aug 2026

    Summary: Malicious code in entropyeasybots (npm)

    Details: Source: amazon-inspector (82e7d0cd2ef4870fdc4484c815737ade78e04bdac4843df02f5cf876cfa3dbaa) index.js decodes a base64-obfuscated IP (85.137.253.124) and connects a spawned /bin/sh subprocess's stdio to a TCP socket at 85.137.253.124:1111, granting remote shell access on the installer's host. package.json declares `postinstall: sudo node install.js`, and install.js uses node-linux's Service API to register a systemd unit named `CustomBot` that runs index.js with maxRestarts:10, providing root-level persistence of the backdoor across reboots. The C2 IP is stored as a base64 string and reconstructed at runtime to hide the destination.

    References: https://www.npmjs.com/package/entropyeasybots/v/2.0.2

    Affected packages

    Package

    Name: entropyeasybots

    Purl: pkg:npm/entropyeasybots

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.0.2
    MAL-2026-11539 | CVE-DB