MAL-2026-17330

Dashboard / Malicious Package / MAL-2026-17330

MAL-2026-17330

Summary: Malicious code in imgbundle (npm)

Details: Source: amazon-inspector (e14218599b46d143fa8e150156864d14d58c327bd8a8816221ac4e8c5cc99350) The package advertises itself as an image bundler, but index.js performs no image bundling. On require, a top-level IIFE reads an AES-256-CBC-encrypted file at `cdn-img-fetch/.cache/banner.jpg` inside the sibling dependency `cdn-img-fetch`, decrypts it with a hardcoded key derived from `sha256('nif-runtime-2027')`, writes the plaintext to `cdn-img-fetch/.runtime/rt.jpg`, deletes the source file, and registers an `fs.watch` on the source directory so the decrypt-and-stage step still fires if the encrypted blob is delivered later. The package also calls `cif.ensureCached()` on the `cdn-img-fetch` dependency in an error-recovery path, wiring the two packages together as a coordinated staged dropper: `cdn-img-fetch` supplies the encrypted bytes and `imgbundle` acts as the decoder that materializes attacker-controlled content onto the installer's filesystem at import time. The README description of image bundling does not correspond to any code path in the module, and hardcoded-AES-key decryption of an opaque blob from another package is not a legitimate implementation of that stated purpose. Source: ghsa-malware (6175161f6fa075711e55b1f0db7d346357ce5593b1e3b48fc30cd85aaad81576) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References: https://www.npmjs.com/package/imgbundle/v/1.0.0, https://www.npmjs.com/package/imgbundle/v/1.0.1, https://github.com/advisories/GHSA-hj6h-6xgx-mpjv