MAL-2026-14280

Dashboard / Malicious Package / MAL-2026-14280

MAL-2026-14280

Summary: Malicious code in mutex-core (npm)

Details: Source: amazon-inspector (8c015af803d9d4adc7d0578dc27795ebaef48e6ce25e9bf715b54af1e4991999) The package is published under a name resembling the popular async-mutex library and, beyond advertised mutex functionality, contains a staged loader. lib/Mutex.js's Mutex.prototype.runExclusive checks whether a callback's meta.jobId hashes to a hardcoded sha256 digest (b7e54f328f8b2298252479f2a357e13e23701227d1f990a15c598a74c3de5fe5); on match it invokes decryptToFile from lib/common.js to AES-256-GCM-decrypt the sibling file lib/withMutex.min.js — a ~17KB base64 literal decoding to ~12.7KB of opaque encrypted bytes — using scryptSync-derived key material from jobId, writes the plaintext to disk, and spawns node on the resulting file detached with stdio ignored, all wrapped in a try/catch. lib/common.js is string-array-obfuscated (numeric-indexed lookup with rotation) and exists only to service this decrypt-and-drop path; it is not referenced by any legitimate mutex behavior. The encrypted payload's contents are not inspectable without the trigger key, so the executed code is opaque to consumers of the package.

References: https://www.npmjs.com/package/mutex-core/v/2.1.2