MAL-2026-15907
Dashboard / Malicious Package / MAL-2026-15907
MAL-2026-15907
Summary: Malicious code in tiny-folder-tree (npm)
Details: Source: amazon-inspector (fb7707665659f287294c31f37c4eff9ceba537e9b54859837615929c296a9540) [email protected] declares a postinstall script (src/build.js) that runs on `npm install`. The script performs a DNS TXT lookup for spreadsheets-documents.com and, when the first character of the first TXT record is '1', invokes src/tools.js which issues an HTTPS request to a URL reconstructed at runtime from obfuscated numeric constants in src/const.js (base-77/base-45 encoded strings decoding to 'https' and an 'HTTPS://...' URL). The response's 'm' header is passed directly to child_process.execSync, yielding arbitrary attacker-controlled shell execution on the installer's machine. The require target for the HTTPS module and the destination URL are both reconstructed via helpers (normalize_hash / normalize_hash_map) to evade static analysis. An author-username bypass ('justin') skips execution on the author's own host, confirming the code is intended to fire on other installers rather than the maintainer.
Affected packages
Package
Name: tiny-folder-tree
Purl: pkg:npm/tiny-folder-tree
Affected ranges
Type: N/A
Events:
