MAL-2026-14275

    Dashboard / Malicious Package / MAL-2026-14275

    MAL-2026-14275

    Published: 19 Aug 2026Last Modified: 19 Aug 2026

    Summary: Malicious code in minequest (npm)

    Details: Source: amazon-inspector (54dfa76784b35d5d63fa89a85c071e83d21e55291871b40627c36015291f24a1) package.json declares a postinstall hook running scripts/init.js, which chmod 0755's assets/thanks-amd64.elf and execFileSync's it on Linux x64 during npm install. The README states the package has 'no install hooks, no native binaries — just readable JavaScript', and scripts/build-elf.js is written to look like a fully-auditable ~250-byte hand-assembled ELF that only prints a thank-you message. The binary actually shipped in the tarball is a 33,648,788-byte Go-compiled executable (sha256 05b696…4420) containing Go runtime symbols, chacha8, and references to /proc/self/cgroup, /proc/self/mountinfo, and syscall filter strings — an artifact with no relationship to the shipped build script. The documented audit path is a cover story for an opaque native binary that executes with installer privileges on every Linux x64 npm install, with no description of its actual behavior available to the installer.

    References: https://www.npmjs.com/package/minequest/v/0.1.1

    Affected packages

    Package

    Name: minequest

    Purl: pkg:npm/minequest

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.1.1