MAL-2026-16384

    Dashboard / Malicious Package / MAL-2026-16384

    MAL-2026-16384

    Published: 22 Sept 2026Last Modified: 22 Sept 2026

    Summary: Malicious code in tldriver (npm)

    Details: Source: amazon-inspector (c16e29eeb8037e1166c10990a8e8f9424095dacc208961fd85775b1b14470995) The npm package [email protected] contains byte-identical scripts/preinstall.js and scripts/postinstall.js that are heavily obfuscated using obfuscator.io-style string-array indirection (identifiers such as _0x5694, _0x5c7e) to hide their URLs, filenames, and shell commands. On install, the scripts perform an https.get to the anonymous third-party image host https://api.imghippo.com/files/hOG8244hc.png, write the returned bytes to the package directory as gldriver_pre_core.exe and gldriver_pre_asset.exe, and then execute them via a platform-branched shell call (mspaint on Windows, open on macOS, xdg-open on Linux) before deleting the files and writing a.pre_setup_complete marker. The package identity is inconsistent with its shipped code: package.json declares the name tldriver, README instructs `npm install googledriver`, and index.js exports a class documented as GoogleDriver wrapping Google APIs, while the lib/ directory contains plausible-looking Google OAuth/Drive/Calendar/Maps modules that are never required by index.js. The declared library surface functions as a cover story; the operative behavior is the lifecycle-time fetch and execution of opaque bytes from a mutable third-party host, which lets the operator of that host deliver arbitrary code to any installer at any time.

    References: https://www.npmjs.com/package/tldriver/v/0.0.1

    Affected packages

    Package

    Name: tldriver

    Purl: pkg:npm/tldriver

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.0.1