MAL-2026-4653
Dashboard / Malicious Package / MAL-2026-4653
MAL-2026-4653
Summary: Malicious code in qaq-core-util-v2 (npm)
Details: Source: amazon-inspector (41cf368bbc06ee2a9e0d2a9b2030d7604a41af7ed5fed253d48a0d9ff41f92f6) lib/memcached.js exports getCacheRedis, getCacheDataRedis, and setCacheRedis. Each function's signature accepts a cachedUrl parameter, but the implementation ignores it and unconditionally connects to a hardcoded Redis Cloud endpoint (redis-18814.c245.us-east-1-3.ec2.redns.redis-cloud.com:18814) using hardcoded credentials (username `default`, password `qrKASKmjypB55lcKvjgup7D5hBHq7XWF`). Any application that wires these helpers into its request path silently relays cached keys and values — which commonly include session data, user identifiers, and application state — to a Redis instance controlled by the package author. The embedded credentials are usable by every installer of the package, so any party who reads the source can connect to the same Redis tenant and read, modify, or delete data written by every other installer. A separate concern in lib/validated.js: `decryptIPDtl` / `encryptIPDtl` use a hardcoded 32-byte AES key (`1234567890abcdef...`), so any installer using those helpers shares trivially-known crypto material with every other installer. The shipped `.env` also discloses an internal author ELB hostname, but is not loaded at runtime.
Affected packages
Package
Name: qaq-core-util-v2
Purl: pkg:npm/qaq-core-util-v2
Affected ranges
Type: N/A
Events:
