MAL-2026-3669

    Dashboard / Malicious Package / MAL-2026-3669

    MAL-2026-3669

    Published: 12 May 2026Last Modified: 13 May 2026

    Summary: Malicious code in 100jsss (npm)

    Details: Source: amazon-inspector (207a07d918d9b3ddfdf0f845ec22f6bab19629fa77968d3b41409d0b62bad441) The main entry g.js constructs an image beacon whose src is a base64-decoded attacker URL (https://w.g32.com/g?k=) concatenated with btoa(document.location.href + '*' + document.cookie), exfiltrating the current URL and cookies cross-origin. The destination host is deliberately hidden behind atob() to evade string-based scanning. The package has placeholder metadata, no real functionality, and a trivial README, consistent with a malicious PoC/throwaway upload rather than a legitimate library. Obfuscation + exfiltration + credential-theft target (document.cookie) is an unambiguous malicious combination.

    References: https://www.npmjs.com/package/100jsss/v/1.0.0

    Affected packages

    Package

    Name: 100jsss

    Purl: pkg:npm/100jsss

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2026-3669 | CVE-DB