Malicious code in open-item-validator (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (7ba5b55d57f4938bf2494d369d14434bb80ba6f6c712c7f8d89ae773c27dc457) On require(), index.js spawns a detached, unref'd background Node process (lib/check-items.js) that repeatedly HTTP-GETs a JSON payload from http://itemx.servegame.com:8888/api/x-realtime and executes the returned JavaScript via new Function('require','module', payload.code)(require, moduleObj). The daemon survives the parent process and re-polls the endpoint on a configured interval, so whoever controls that endpoint runs arbitrary Node code on the installer's host on library load and continuously thereafter. The fetch is over plain HTTP to a No-IP dynamic-DNS host (servegame.com) that does not match the publisher's declared homepage (game.spawnrealm.com); a bundled RSA signature check does not alter that the endpoint operator chooses what code runs. README framing as 'signed game code updates' is inconsistent with the shipped generic fetch-and-exec mechanism and the publisher/destination host mismatch. ## Source: ghsa-malware (5734c86f1289f980635bd730b9fe0a87dc2def30694a0beedf1fb84ab7303b66) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that re
MAL-2026-16052
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-16052
open-item-validator
Source reference: /affected/0/package/name
- Affected versions
- 1.0.3
Source reference:
/affected/0/versions1.0.5Source reference:
/affected/0/versions1.0.2Source reference:
/affected/0/versions1.0.0Source reference:
/affected/0/versions1.0.4Source reference:
/affected/0/versions1.0.1Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "open-item-validator",
"purl": "pkg:npm/open-item-validator",
"ecosystem": "npm"
},
"versions": [
"1.0.3",
"1.0.5",
"1.0.2",
"1.0.0",
"1.0.4",
"1.0.1"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/open-item-validator/MAL-2026-16052.json",
"indicators": {
"evidence_files": [
{
"path": "lib/check-items.js",
"tlsh": "3491734ead4b92371eb742f44317502afb5e91932691d205bbcdd34c2fb8118e325cea",
"sha256": "4b73aed06386ca7d176db5e8da14cdcf33a78e9d25b2d5ae31a6206133a246a0"
},
{
"path": "index.js",
"tlsh": "d11121ea32caa52a7c32afe1e9338111be16c11277004001b9edbad60fe19864353cbd",
"sha256": "0f036bd6bbfba26d056465135e91d99bd428210fdc42473ab463bae06e21a32e"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "e267496a8e5871b9b287b0646d1c0419ab98230b",
"sha512_sri": "sha512-iHtWqOLOZCP2tMXCKpKbeyZumJ0FoSEjwqLFnKULXIK9ja8IfhO4c1g6hivmHBfggM8ejgGZcfaOXW2Na5HGIQ=="
},
"filename": "open-item-validator-1.0.3.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #21254 · Revision 1
- Added to Heist Feed
- Publisher date