MAL-2026-3682

    Dashboard / Malicious Package / MAL-2026-3682

    MAL-2026-3682

    Published: 12 May 2026Last Modified: 13 May 2026

    Summary: Malicious code in @chahuadev/junk-sweeper-app (npm)

    Details: Source: amazon-inspector (3d446150767f92344d8d0a699f5879bd746200fb8beb60554408699868f03d51) The package's postinstall script (package.json line 10: "postinstall": "node install.js") unconditionally fetches a platform-native executable from https://pub-419d22521da042dfb27d1f404b3eb8a6.r2.dev/Junk-Sweeper.exe or /Junk-Sweeper.AppImage, writes it into the package's bin/ directory, and chmods it 0755 on Linux (install.js lines 10, 14-22, 30-67). No SHA-256, signature, or size verification is performed, and HTTP redirects are followed blindly. The package's bin entrypoint (index.js line 32) then spawnSync's the downloaded binary with the user's argv and inherited stdio, giving the bucket owner a persistent, mutable remote-code-execution channel into any installer machine. The hosting domain is an opaque object-storage bucket, not a versioned release artifact from a transparent source (GitHub Releases with tag pinning, npm registry, etc.). Whether or not the current binary contents are malicious, the delivery mechanism allows the content to be swapped at any time without any version change to the npm package.

    References: https://www.npmjs.com/package/@chahuadev/junk-sweeper-app/v/2.0.3

    Affected packages

    Package

    Name: @chahuadev/junk-sweeper-app

    Purl: pkg:npm/%40chahuadev/junk-sweeper-app

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.0.3
    MAL-2026-3682 | CVE-DB