MAL-2026-6687

Dashboard / Malicious Package / MAL-2026-6687

MAL-2026-6687

Summary: Malicious code in procwire (npm)

Details: Source: amazon-inspector (011cf28d546459d946b1ed6d92c3beb4cb7c5322d6a9370d52fcd40e9a81ac2f) On Windows, installing [email protected] automatically downloads and executes an attacker-controlled executable. The package.json `preinstall` script runs lib/setup.js, which platform-gates to win32, then constructs a download URL by XOR-decoding values pulled from two floating-version sibling packages (`endpointmap: "*"` and `bytecraft: "*"`) — splitting the C2/payload reference across separate packages so it can be rotated post-publication without modifying procwire itself. lib/worker.js obfuscates every sensitive identifier through `String.fromCharCode.apply(null, [...])` arrays — the strings 'https', 'child_process', 'spawn', 'curl.exe', 'bitsadmin', 'powershell.exe', 'cmd.exe', ':Zone.Identifier', the fake update filename prefixes, and the `Microsoft-Delivery-Optimization/10.0` User-Agent are all assembled at runtime to defeat static analysis. The download uses a three-tier fallback (Node https, curl.exe, bitsadmin) with TLS verification disabled (`rejectUnauthorized: false`) and ranged-resume support, saves the binary to `%LOCALAPPDATA%\Temp` under names such as `msedge_update_*.exe`, `chrome_installer_*.exe`, or `teams_update_*.exe`, strips the Mark-of-the-Web `:Zone.Identifier` alternate data stream to bypass SmartScreen, then spawns the executable hidden and detached (`detached: true, stdio: 'ignore', windowsHide: true`). The advertised purpose of procwire is a process-IPC library, which has no need to fetch or execute any external binary. The combination — preinstall lifecycle hook, win32 gating, split-payload URL via wildcard siblings, identifier obfuscation, TLS-verify disabled, fake update filenames, MOTW stripping, hidden execution — is unambiguous malware behavior. Source: ghsa-malware (5d0d931d4a5440dd83a5f390facfb46b9c0d0cef0c1574a664760d3bd9c8b41a) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References: https://github.com/advisories/GHSA-5r42-357x-f2mx, https://www.npmjs.com/package/procwire/v/2.0.0, https://www.npmjs.com/package/procwire/v/1.3.0, https://safedep.io/procwire-npm-windows-dropper-campaign