MAL-2026-14347

Dashboard / Malicious Package / MAL-2026-14347

MAL-2026-14347

Summary: Malicious code in mcq-session (npm)

Details: Source: amazon-inspector (1acf694ae0258defc54c414980c5f8512b7055e69630ede15a8bfb37d2005b9b) On any require()/import of mcq-session, the main module runs a top-level async IIFE that reads a file at../../../../public/logo.ico (a path escaping the package root into a host application's public assets), DES-decrypts the bytes with a hardcoded password 'bf497c0b9cee' using multiple CryptoJS decode formats, and pipes the decrypted plaintext into a detached, unref'd 'node' subprocess via stdin. The decrypted content is treated as executable JavaScript with no signature check, integrity verification, or user gate. The loader is disguised behind cover-story identifiers ('readLogoIco', 'ThetaSDK initialization'). The symmetric key ships alongside the loader, so the encryption serves only to defeat static inspection of the staged payload. The out-of-package path indicates the payload is dropped separately alongside a host application, making the on-disk blob attacker-controlled from the installer's perspective.

References: https://www.npmjs.com/package/mcq-session/v/1.0.4, https://www.npmjs.com/package/mcq-session/v/1.0.3