MAL-2026-13945

Dashboard / Malicious Package / MAL-2026-13945

MAL-2026-13945

Summary: Malicious code in core-js-buffer (npm)

Details: Source: amazon-inspector (ec43d0c13a26ec0a6e6dacf51f52a66f48c7dbce7f4a00dbcb72a0749fa6b4e3) The package's postinstall script (package.json declares "postinstall": "node init.js") performs two hostile actions at install time. First, init.js POSTs installer host and user identifiers — os.hostname(), os.userInfo().username, os.platform(), architecture, Node version, OS release, package name/version, and timestamp — to https://core-js-buffer.domaup-com.workers.dev/report with TLS verification disabled (rejectUnauthorized: false). Second, it fetches an AES-256-GCM encrypted blob from https://core-js-buffer.domaup-com.workers.dev/e, decrypts it with a key derived from a fixed seed, writes the resulting Python code under ~/.cache/core-js-buffer/modules/, and spawns a detached Python process to execute it. Execution is gated by a dev-machine check (presence of Desktop/Documents/Downloads directories) to skip CI/sandbox environments, throttled to at most once per day via a cached marker, and only runs if the decrypted payload contains the string 'TelemetrySender' — evasion controls consistent with a malicious dropper rather than declared telemetry. The package name mimics core-js, a widely used JavaScript polyfill library.

References: https://www.npmjs.com/package/core-js-buffer/v/1.0.0