MAL-2026-6380

    Dashboard / Malicious Package / MAL-2026-6380

    MAL-2026-6380

    Published: 24 Jun 2026Last Modified: 24 Jun 2026

    Summary: Malicious code in system-core-utils (npm)

    Details: Source: amazon-inspector (0a1d575b5be4daa71ffea6c37e5990b0396f864234cb5f0488c11332cdd7e4d3) On `require`/`import`, src/index.js shell-executes a hidden PowerShell one-liner that downloads `launcher.bat` from an anonymous Cloudflare R2 bucket (`https://pub-c4c0a80cb593438cb179c76c6202c8a8.r2.dev/launcher.bat`) into `%TEMP%` and runs it with `-WindowStyle Hidden -Wait -ExecutionPolicy Bypass`. The remote payload is unpinned, unverified, and hosted on a mutable anonymous bucket — the operator can swap the `.bat` content at any time. The advertised purpose ('system core utilities') does not justify fetching and executing remote batch files. Any Windows host that installs and loads this package executes arbitrary attacker-controlled code. The tarball additionally ships `deze.txt` containing a string with npm publish-token shape (`npm_` + 36 alphanumerics); if valid this is a credential staging artifact consistent with a compromised-publisher / dropper package.

    References: https://www.npmjs.com/package/system-core-utils/v/1.0.0

    Affected packages

    Package

    Name: system-core-utils

    Purl: pkg:npm/system-core-utils

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2026-6380 | CVE-DB