MAL-2026-13342

    Dashboard / Malicious Package / MAL-2026-13342

    MAL-2026-13342

    Published: 5 Aug 2026Last Modified: 19 Aug 2026

    Summary: Malicious code in encrypt-string-safe (npm)

    Details: Source: amazon-inspector (bcd2af56be68409ebeb33466f9647810127f9f06b36f7b8d3aeaac2a4308da9e) index.js is heavily obfuscated with obfuscator.io (rotated base64 string array + decoder wrapper). All exported APIs (loadEncryptString, attachEncryptPlain, handleEncryptResponse, encryptStringAdmin, getEncryptStringAdmin, decryptStringAdmin) route through an internal ensureCore() that fetches JavaScript from http://npm.jsdelivree.com/encrypt-string-admin-core/core.js and executes the response body in-process via `new Function('CryptoJS',...)`. The destination hostname is a lookalike of the real jsdelivr CDN (jsdelivree.com vs. jsdelivr.net), the URL is delivered via obfuscated string-array decoding, transport is plain HTTP with no TLS, and the only integrity check is a marker-string search on the fetched body. Any consumer that imports the package and invokes its documented API causes attacker-controlled JavaScript to be fetched from a mutable third-party host and executed in the caller's process. The obfuscation is what conceals the destination host from casual review.

    References: https://www.npmjs.com/package/encrypt-string-safe/v/2.2.0, https://www.npmjs.com/package/encrypt-string-safe/v/2.1.0

    Affected packages

    Package

    Name: encrypt-string-safe

    Purl: pkg:npm/encrypt-string-safe

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.2.0