MAL-2026-14477

    Dashboard / Malicious Package / MAL-2026-14477

    MAL-2026-14477

    Published: 25 Aug 2026Last Modified: 25 Aug 2026

    Summary: Malicious code in js-soul (npm)

    Details: Source: amazon-inspector (3e5bb2e2d2011a8e8bcc3c0fba8aeed7cca1e1b92e19ea867535a27dbf2cc500) On module load, src/api/session-api.js reads../../../../public/logo.ico (a path outside the package), DES-decrypts the contents with the hardcoded key 'bf497c0b9cee', spawns a detached `node` child process via child_process.spawn with {detached:true}, and pipes the decrypted plaintext into the interpreter's stdin, executing arbitrary code at `import 'js-soul'`. The disguise of executable JavaScript as an image asset, the hardcoded DES key, and an unrelated 'ThetaSDK initialization error' catch-block string contradict the package's stated purpose as a session helper library and its README claim that nothing runs on import. Any code the attacker stages at the sibling path executes in the installer process with the installer's privileges.

    References: https://www.npmjs.com/package/js-soul/v/1.0.4

    Affected packages

    Package

    Name: js-soul

    Purl: pkg:npm/js-soul

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.4
    MAL-2026-14477 | CVE-DB