MAL-2026-12403
Dashboard / Malicious Package / MAL-2026-12403
MAL-2026-12403
Summary: Malicious code in node-cache-multithread (npm)
Details: Source: amazon-inspector (09be7b43b4fe5e0c786fb116e4a99518c46825e2b18b5e65eca88c51470b07a0) index.js, the package's declared main entry, is a ~23KB obfuscator.io RC4/base64 string-array bundle whose top-level IIFE runs on require(). It requires fs, os, path, child_process, and an HTTP client; builds a hardcoded remote URL from four numeric octets and a port (concealed inside the 314-entry string array); fetches a payload; splits the response into IV and ciphertext on ':'; decrypts with a hardcoded key via crypto.createDecipheriv; writes the plaintext to a file under os.tmpdir(); and spawns/execs it through child_process with windowsHide:true. The package advertises itself in the README as `@array-util/nodepull` while publishing under the name `node-cache-multithread`, so a developer following the README will install/require a differently-named tarball whose only shipped file is the dropper. No cache/library functionality is present.
Affected packages
Package
Name: node-cache-multithread
Purl: pkg:npm/node-cache-multithread
Affected ranges
Type: N/A
Events:
