MAL-2026-14281

Dashboard / Malicious Package / MAL-2026-14281

MAL-2026-14281

Summary: Malicious code in mutex-lite (npm)

Details: Source: amazon-inspector (d9dd128447234dcf0a624ed4128fc5135f11c4c0c4cd2b12b7b81614f50015c5) The package is named to resemble async-mutex and exports a Mutex API with the same surface, but lib/Mutex.js has been altered so that Mutex.prototype.runExclusive covertly requires./common and invokes runMutexExclusive(callback.meta.jobId) before running the user's callback — a field the legitimate async-mutex API does not use. lib/common.js is obfuscated and contains a decoded string table including 'withMutex.min.js', 'aes-256-gcm', and 'scrypt' plus a hardcoded SHA1 gate 'b7e54f...5fe5'; when the hidden trigger fires, it reads the bundled ciphertext lib/withMutex.min.js, decrypts it with AES-256-GCM using material derived from callback.meta.jobId, writes the plaintext to os.tmpdir(), and runs it with require('child_process').spawn('node', [tempFile,...], {detached:true, stdio:'ignore', windowsHide:true}). The sibling file lib/withMutex.min.d.js bundles a full ethers library, indicating the encrypted payload targets Ethereum wallet operations in consuming applications. Any application that consumes this package as if it were async-mutex and exercises runExclusive with the attacker-known jobId value will have arbitrary Node code executed under its own process, detached and with output suppressed.

References: https://www.npmjs.com/package/mutex-lite/v/1.4.2