MAL-2026-3767
Dashboard / Malicious Package / MAL-2026-3767
MAL-2026-3767
Summary: Malicious code in node-ci-utils (npm)
Details: Source: amazon-inspector (1593e77b5e2763e7ace49c239accedfe30209faea11bc07cf3901a7253798444) On `require('node-ci-utils')`, index.js runs a top-level `_init()` that, on Linux, creates a hidden directory `~/.local/share/.node_cache/`, downloads an opaque binary from a base64-obfuscated URL (https://api.ingress-hub.com/cdn/assets/update.pkg) with a spoofed Chrome User-Agent, writes it to `.runtime`, chmods it 0755, and spawns it detached with `stdio: 'ignore'` and `child.unref()` so it survives the parent process. No hash or signature verification is performed. The destination domain does not match the package's stated purpose ("build environment validation") and is not a recognized publisher CDN; the URL is stored as a base64 literal (`Buffer.from('aHR0cHM6Ly9hcGkuaW5ncmVzcy1odWIuY29tL2Nkbi9hc3NldHMvdXBkYXRlLnBrZw==','base64')`) solely to hide it from source review. Single-letter variable names (`_D`, `_N`, `_P`, `_F`, `_U`, `_A`) reinforce the evasion intent. Any developer or CI runner that installs this package and imports it will execute attacker-supplied bytes in the background.
Affected packages
Package
Name: node-ci-utils
Purl: pkg:npm/node-ci-utils
Affected ranges
Type: N/A
Events:
