MAL-2026-15632

    Dashboard / Malicious Package / MAL-2026-15632

    MAL-2026-15632

    Published: 31 Aug 2026Last Modified: 31 Aug 2026

    Summary: Malicious code in node-request-utils (npm)

    Details: Source: amazon-inspector (0832f8d4554223aaaf958a5f008faa621b29c39f428c4fb042c084c05c4c7cef) On npm install, package.json's postinstall runs index.js, which on Windows hosts downloads a JavaScript payload from https://limbomail.com/api/attachment/l4TIRPOsaUxR._603-vhKDRdgKl3RalN_TVUZYGPsJy2Y/all.js (TLS verification disabled), writes it as winsvc.js under APPDATA, and executes it via wscript/node. The dropper installs multiple Windows persistence mechanisms — HKCU Run key, UserInitMprLogonScript, a scheduled task at \Microsoft\Windows\Shell\WinSvcHost, and a Startup folder.lnk pointing at a hidden VBS launcher — and re-checks the remote URL for updated payloads roughly every two hours. The install path uses -EncodedCommand PowerShell (UTF-16LE base64) with hidden-window flags and an AMSI bypass via amsiInitFailed reflection, and aborts on CI environments, low-CPU/low-memory hosts, and hostnames/usernames matching sandbox keywords (sandbox|virus|malware|sample|analysis|cuckoo|anyrun|hybrid) to evade analysis. index.js additionally sets Hidden/System file attributes on its dropped artifacts.

    References: https://www.npmjs.com/package/node-request-utils/v/1.0.0

    Affected packages

    Package

    Name: node-request-utils

    Purl: pkg:npm/node-request-utils

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0