Malicious code in serpacksven1 (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (20d4a6a2715973b427bb0aa2b7a493ca711b7f16b5f47f90062edf790e0186a6) The tarball ships no JavaScript — the declared `main: index.js` is absent — and contains only 10 byte-identical copies of a PowerShell dropper under misleading extensions (`1.png`, `client.doc`, `client.doc.1`, `json.txt`, extensionless `client`, all sha256 e9dff494...). The script hides the console window via Win32 APIs, concatenates ~150 base64 chunks, XOR-decodes them with single-byte key 89, reflectively resolves `[System.Reflection.Assembly].Load` through char-code-obfuscated type strings, and invokes the decoded in-memory.NET assembly. The package has no lifecycle scripts and no importable surface, so `npm install` alone does not execute the payload; the harm fires when a second-stage tool or downstream workflow sources any of the disguised files (e.g. `powershell -File client.doc`), delivering full-host code execution of an attacker-controlled.NET assembly on Windows. The multi-extension disguise, byte-identical duplication, and absence of any legitimate package content show this is a payload-staging artifact published to npm rather than a software package. ## Source: ghsa-malware (d0730e12f59904bd205a2a840fce1dbab41414538d235ea91ddb3a23cc2a0b8f) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately fr
MAL-2026-17626
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-17626
serpacksven1
Source reference: /affected/0/package/name
- Affected versions
- 1.0.6
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "serpacksven1",
"purl": "pkg:npm/serpacksven1",
"ecosystem": "npm"
},
"versions": [
"1.0.6"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/serpacksven1/MAL-2026-17626.json",
"indicators": {
"evidence_files": [
{
"path": "1.png",
"tlsh": "74a2af3c916097feec69e74549a3940a65257cf2c4a42c072f1ace6f54a7ec4ecbc18b",
"sha256": "e9dff49447937f8225a73dc235e067de051240d89523b6846813f7a2cd21a8fa"
},
{
"path": "package.json",
"tlsh": "2dd02e288aa2443300c006330d1a91526220ee2f00043c0c37cf241c83dfab26cfa21c",
"sha256": "868ed4eddc1f3785ee6f0140730ae218168b81f2e427fadb7e2167aba1896e58"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #86369 · Revision 1
- Added to Heist Feed
- Publisher date