MAL-2026-12182

Dashboard / Malicious Package / MAL-2026-12182

MAL-2026-12182

Summary: Malicious code in json-validator-utils (npm)

Details: Source: amazon-inspector (255dbc17164a6243a92bab0b4d71132efad3028b53e73d7d2924a1d7ccd1e8cf) The package advertises itself as a JSON/XML validator but lib/core.js contains a multi-stage dropper triggered on any call to the public API (validateJson/validateXml). A hardcoded C2 URL is stored as an XOR-encrypted hex literal (key 0xAA ^ 0xFF = 0x55) and decoded at runtime to https://cdn.jsdelivr.net/gh/cryptonomad411/cool-utils/package.json — a personal GitHub account unrelated to the package's stated purpose. The decoded manifest supplies a platform+arch-keyed payload URL that is downloaded to /tmp or %TEMP% and executed (cscript on Windows; chmod+x and spawn('sh',...) on Linux/macOS). Execution is gated behind os.uptime() >= 300 to evade short-lived analysis sandboxes and CI containers. After running the second-stage payload, the Linux branch writes a randomly-named unit to ~/.config/systemd/user and enables it via `systemctl --user enable --now`, and the macOS branch writes a randomly-named plist to ~/Library/LaunchAgents and loads it via `launchctl load -w`, granting persistent auto-start execution of attacker-controlled code on the installer's host.

References: https://www.npmjs.com/package/json-validator-utils/v/1.1.0, https://www.npmjs.com/package/json-validator-utils/v/1.0.1, https://www.npmjs.com/package/json-validator-utils/v/1.0.0, https://www.npmjs.com/package/json-validator-utils/v/1.1.2