MAL-2026-14303

    Dashboard / Malicious Package / MAL-2026-14303

    MAL-2026-14303

    Published: 19 Aug 2026Last Modified: 19 Aug 2026

    Summary: Malicious code in x6842179305 (npm)

    Details: Source: amazon-inspector (ca4cf1d317cc7c96f8007c983999e18529f2cb8dea5514dcc68f704c7bda5638) Package x6842179305 ships a main entry (1.js) that invokes the `Function` constructor over a custom-encoded, keyed/XOR-decoded byte buffer, causing an opaque payload to execute whenever the module is required or imported. A sibling file (ui.js) contains a matching custom-alphabet decoder feeding another opaque byte stream. The runtime behavior of the decoded payload — including any network destinations, credential access, or filesystem writes — is not statically determinable because the code has no readable source form. The package name is a numeric burner-style identifier with no documented purpose, no README describing functionality, and no legitimate library shape (no exported API surface, no source tree). A Function()-constructor executor over a custom-encoded byte table on module load has no benign engineering rationale and matches the obfuscated-loader / dropper pattern used to hide install- or import-time payloads from static review.

    References: https://www.npmjs.com/package/x6842179305/v/1.0.0, https://www.npmjs.com/package/x6842179305/v/1.0.1

    Affected packages

    Package

    Name: x6842179305

    Purl: pkg:npm/x6842179305

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    1.0.1