MAL-2026-13378

Dashboard / Malicious Package / MAL-2026-13378

MAL-2026-13378

Summary: Malicious code in npm-dc-dev (npm)

Details: Source: amazon-inspector (91248167ea052dfca231e837bd645444f362dc087be9a7c04f1cf4aeec4d6723) package.json declares `"postinstall": "node test.js"`. test.js top-level `require('.')`s index.js and awaits an exported `from_str()`. index.js consists of a single `Function("k4Wmku", "...")` invocation whose ~170KB body is encoded with a custom 85-character alphabet and a shuffled string array; standard deobfuscation does not recover the payload. On `npm install`, the postinstall hook constructs and runs this opaque code on the installer's machine, with `child_process`, `axios`, and `form-data` available as declared dependencies. Package metadata is generic (blank author and description, name `npm-dc-dev`) and no legitimate library surface is exported. The install-time construction and execution of an unreadable dynamic payload matches the install-time remote-code-execution pattern; no benign reason exists for this shape.

References: https://www.npmjs.com/package/npm-dc-dev/v/1.1.1