MAL-2026-12339
Dashboard / Malicious Package / MAL-2026-12339
MAL-2026-12339
Summary: Malicious code in async-mutex-hook (npm)
Details: Source: amazon-inspector (624c93cbd007656467757c5504db29971b220bc36685eda2af6a1d1390715133) Package is published under the name async-mutex-hook and self-describes as a Promise-based mutex library, but ships no mutex implementation. Its exported getPlugin function issues an HTTPS request to the hardcoded bare-IP endpoint https://46.183.25.232:45000/icons/108 and passes the response's `credits` field to `new Function('require','module','exports',...,'Promise', data.credits)`, executing attacker-controlled JavaScript with full Node.js privileges (require, process, Buffer, and shipped dependencies injected). The declared dependencies (@primno/dpapi for Windows DPAPI, better-sqlite3/sqlite3 for browser cookie and login databases, node-machine-id) are unrelated to any mutex functionality and are the standard building blocks for browser-credential and DPAPI theft, matching the capability the remote payload would need to invoke on the installer's host.
Affected packages
Package
Name: async-mutex-hook
Purl: pkg:npm/async-mutex-hook
Affected ranges
Type: N/A
Events:
