MAL-2026-12177

    Dashboard / Malicious Package / MAL-2026-12177

    MAL-2026-12177

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in devpack-conf (npm)

    Details: Source: amazon-inspector (fabc4baeb912d72d08ef42d8b6b5e147b1f7dc18fc01e796bc6ac17f1c7dff68) [email protected] is a typosquat of pkg-conf. index.js contains a top-level eval(atob(...)) that decodes an obfuscated loader. The loader queries Ethereum RPC/blockscout endpoints for transactions from the hardcoded address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, extracts an IPv4 address from the transaction's `to` field, fetches an XOR-encoded payload from http://<resolved-ip>:443/0x/cls and /0x/ls (XOR key delivered via the x-payload-b64 response header), eval()s the decrypted payload, and spawns a detached `node -e <payload>` child process with stdio:'ignore' and windowsHide:true. Sensitive strings (`http`, `https`, `child_process`, `spawn`, endpoint paths) are hidden behind \u unicode escapes. The malicious code executes automatically at require/import time on any consumer of the package.

    References: https://www.npmjs.com/package/devpack-conf/v/5.0.0

    Affected packages

    Package

    Name: devpack-conf

    Purl: pkg:npm/devpack-conf

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    5.0.0
    MAL-2026-12177 | CVE-DB