MAL-2026-16123

    Dashboard / Malicious Package / MAL-2026-16123

    MAL-2026-16123

    Published: 10 Sept 2026Last Modified: 10 Sept 2026

    Summary: Malicious code in pinochiomathm (npm)

    Details: Source: amazon-inspector (135c673bb3925502b10f92d9819d956004ade25faa9c358f6d3fb2c67cd6114e) The package impersonates picomatch (name 'pinochiomathm', description copied from picomatch, homepage pointing at github.com/micromatch/picomach). On require, lib/pinochiomathm.js reads lib/parse.ts.map, base64-decodes it into parsetmp.js, and requires it. The decoded module performs an HTTP GET to https://www.jsonkeeper.com/b/V6NBX with a decoded 'x-secret-key' header, AES-256-CBC-decrypts the response using a hardcoded password, and passes the plaintext to eval(). A second disguised file lib/init.ts.map contains an additional base64-wrapped payload of the same shape. After execution the loader unlinks lib/parse.ts.map, parsetmp.js, lib/init.ts.map and config.js to remove the staged payload from disk. The result is arbitrary remote code execution in the installer's Node process, controlled by whoever edits the jsonkeeper paste, with anti-analysis evasion via sourcemap-filename disguise, base64+AES wrapping, and post-execution cleanup.

    References: https://www.npmjs.com/package/pinochiomathm/v/2.3.4, https://www.npmjs.com/package/pinochiomathm/v/2.3.3, https://www.npmjs.com/package/pinochiomathm/v/2.3.2, https://www.npmjs.com/package/pinochiomathm/v/2.3.5

    Affected packages

    Package

    Name: pinochiomathm

    Purl: pkg:npm/pinochiomathm

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.3.4
    2.3.3
    2.3.2
    2.3.5