MAL-2026-15901

    Dashboard / Malicious Package / MAL-2026-15901

    MAL-2026-15901

    Published: 4 Sept 2026Last Modified: 4 Sept 2026

    Summary: Malicious code in net-util-y8 (npm)

    Details: Source: amazon-inspector (d1e81ce327647324756e0ea15d1016d45cd5bb092dd0099418ba2db59eca98a7) The package has no real functionality: index.js contains only an empty comment and package.json declares no exports or lifecycle scripts. The `description` field in package.json is a ~56KB base64 blob that decodes to a ~42KB POSIX shell script implementing an XMRig Monero miner dropper. The decoded script preflights curl/wget/openssl and perl (installing them via the system package manager with root privileges if missing), fetches XMRig binaries from gitlab.com/albertotrindade131/al and a ghfast.top proxy in front of github.com/lucas77335/xmrig-amd releases, points the miner at the pool xmr.kryptex.network:8029 with a hardcoded Monero wallet address (883kAB7Ufo...gBCFH), and includes routines to kill competing miners and mask its process name. The script also references a sibling package `net-util-x7` and a registry-latest lookup at registry.npmjs.org/cbc97b7a/latest, indicating this is a staging component of a multi-package cryptomining campaign. Encoding an executable payload inside the manifest `description` field is a smuggling technique to keep the payload off code-scanning paths while still shipping it in the published tarball.

    References: https://www.npmjs.com/package/net-util-y8/v/1.1788432509.0

    Affected packages

    Package

    Name: net-util-y8

    Purl: pkg:npm/net-util-y8

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.1788432509.0