MAL-2026-13921
Dashboard / Malicious Package / MAL-2026-13921
MAL-2026-13921
Summary: Malicious code in envpack-conf (npm)
Details: Source: amazon-inspector (a061ac72b9e392fee182ad4873aab0cc9a64694a11228438a7838343b96d338f) envpack-conf 1.0.1 is a trojanized copy of the pkg-conf utility. index.js appends a top-level async IIFE that runs whenever the module is imported. The IIFE queries public Ethereum RPC endpoints (eth.blockscout.com/api, 1rpc.io/eth, eth.drpc.org, ethereum-rpc.publicnode.com, eth-mainnet.public.blastapi.io) for transactions sent from the attacker address 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, decodes the `to` field of those transactions into two IPv4 addresses, fetches an XOR-encrypted second-stage payload from those hosts at path /0x/cls, and executes the decrypted payload with both eval() and spawn('node',['-e',<payload>],{detached:true,stdio:'ignore'}).unref(), giving a detached child process on the installer's host. Every sensitive identifier (module names http/https/zlib/child_process, hostnames, HTTP methods, header names, the attacker address, the RPC URLs, request paths, and global variable names) is written as \uXXXX-escaped literals to evade static analysis. The package name and README (`devpack-conf`) impersonate Sindre Sorhus's `pkg-conf`; package.json lists the author as 'Sinde Sorus' <[email protected]>, a typosquat of the real maintainer. The legitimate pkg-conf source is preserved above the injected block as cover.
Affected packages
Package
Name: envpack-conf
Purl: pkg:npm/envpack-conf
Affected ranges
Type: N/A
Events:
