MAL-2026-5527

Dashboard / Malicious Package / MAL-2026-5527

MAL-2026-5527

Summary: Malicious code in check-error-util (npm)

Details: Source: amazon-inspector (7c25cbbb904c18028cac363ba66eb89d91301bd3204a8347834e52387b4b575e) On require/import, index.js executes a top-level resolveConfig() that reconstructs a URL from an XOR-obfuscated integer array, AES-256-CBC-decrypts it, fetches the URL over HTTPS, and runs the JSON `cookie` field of the response as JavaScript via `new Function('require', cookie)(require)`. This grants an attacker arbitrary Node code execution with full `require` access on any machine that loads the package. The URL is hidden behind a layered XOR + AES blob (getHashAddress → Buffer.from(...,'hex') → createDecipheriv('aes-256-cbc', key, iv)) with cover-story comments ('S-box substitution', 'address pipeline', 'service layer hydration') intended to evade static review — there is no legitimate reason for an error-comparison utility to ship encrypted remote URLs. The package also impersonates the legitimate chaijs `check-error` library: package.json copies the upstream author Jake Luer <[email protected]>, the chaijs contributor list, and a repository URL pointing at chaijs/check-error, while the published name is `check-error-util` and the upstream loader code is absent from the real package.

References: https://www.npmjs.com/package/check-error-util/v/2.1.4, https://www.npmjs.com/package/check-error-util/v/2.1.6, https://www.npmjs.com/package/check-error-util/v/2.1.5, https://www.npmjs.com/package/check-error-util/v/2.1.7, https://www.npmjs.com/package/check-error-util/v/2.1.3, https://www.npmjs.com/package/check-error-util/v/2.1.8