MAL-2026-14265

    Dashboard / Malicious Package / MAL-2026-14265

    MAL-2026-14265

    Published: 19 Aug 2026Last Modified: 19 Aug 2026

    Summary: Malicious code in easydsbots (npm)

    Details: Source: amazon-inspector (6c3ee114e4ac67d2d02a9668c7ed0b38cbf62f9bc59e35b92c0ff9e713d3a688) package.json declares `"postinstall": "sudo node install.js"`, escalating to root on `npm install`. install.js is heavily obfuscated (obfuscator.io: rotated 140-entry string array `a0_0xdc68`, hex-encoded property lookups, control-flow flattening, self-defending stubs) so the executed behavior is deliberately hidden from installers. index.js is similarly obfuscated (rotated 164-entry string array `a0_0x53d8`, runtime base64 decoding via `Buffer[...](ertrf,...).toString()`), declares `js-virtualizer` as a runtime dependency, and reads `process.env.INVOCATION_ID` into an `isRunningAsService` flag — an environment variable set only when a process is launched by systemd. The package also depends on `node-linux`, a library that registers /etc/init.d or systemd unit files. The combination — root-level lifecycle hook, opaque payload, systemd-context branch, and a daemon-installer dependency — is the shape of an obfuscated root-persistent daemon dropper executed at install time on the installer's host.

    References: https://www.npmjs.com/package/easydsbots/v/1.0.0

    Affected packages

    Package

    Name: easydsbots

    Purl: pkg:npm/easydsbots

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0