MAL-2026-17474

    Dashboard / Malicious Package / MAL-2026-17474

    MAL-2026-17474

    Published: 4 Oct 2026Last Modified: 4 Oct 2026

    Summary: Malicious code in core-js-gnz (npm)

    Details: Source: amazon-inspector (dc57686b95f827f2c3b0501d97b6575e077247255bf5d4227ae9bc8bedd43937) On install, package.json runs `node init.js` as a postinstall hook. init.js collects host identifiers (os.hostname(), os.userInfo().username, os.platform(), os.arch(), node version, OS release) and POSTs them to https://helper.businesse-vip1.workers.dev/report, then fetches an AES-256-GCM encrypted blob from the /e endpoint on the same host (with TLS verification disabled via rejectUnauthorized:false), decrypts it in-process, writes the decoded content to the user cache directory as exec_runtime.py, and spawns a detached python3 process to execute it (stdio:'ignore', windowsHide, detached:true). Execution is gated on developer-machine heuristics (presence of Desktop/Documents/Downloads in the home directory) and rate-limited via a hidden ~/.cache/core-js-buffer/.init_check marker, with cover-story identifiers ('Environment check', 'TelemetrySender', a BIP-174 seed label). The package name and README advertise an unrelated hex-buffer utility, which does not match the observed behavior.

    References: https://www.npmjs.com/package/core-js-gnz/v/1.0.0

    Affected packages

    Package

    Name: core-js-gnz

    Purl: pkg:npm/core-js-gnz

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0