Malicious code in homestack-cheer (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f475cd8b8a3e1dd4563ca0b20d85fde83576ed78c27eb91ca1cd77fbebe0d142) The package is published as homestack-cheer with description 'JS lib support cheerleading', but the README and the UMD build (dist/my-lib.umd.js) present it as a trivial hello-world 'greet' library. The ESM entrypoint declared in package.json 'module' (src/index.js) and src/env_load.js each end with `new Function(atob('<~180KB base64>')).call(this)`, decoding an obfuscated second-stage payload via a runtime string-shuffle routine. When a downstream project bundles this package with webpack/rollup, the ESM path is resolved and the hidden payload is embedded into the resulting application bundle and executed in end-users' browsers. The decoded payload checks `window.location` for the substring 'checkout' and, when a Stripe payment element iframe (#stripe-payment-element iframe) is present, hides the real Stripe iframe, clears the disabled state on the place-order button, and injects a look-alike iframe with id `__privateStripeFrame84331` to intercept card input. The divergence between the benign `main` (UMD greet) and the malicious `module` (ESM Function(atob(...))) constitutes deliberate dual-entrypoint smuggling designed to evade casual review of the package's headline file. ## Source: ghsa-malware (b0622f60729e4dec05a0c9f802b4728a7c579d968532a87d664b759da856ad27) Any computer that has this package installed or running shou
MAL-2026-16333
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-16333
homestack-cheer
Source reference: /affected/0/package/name
- Affected versions
- 1.1.9
Source reference:
/affected/0/versions1.1.8Source reference:
/affected/0/versions1.1.7Source reference:
/affected/0/versions1.1.6Source reference:
/affected/0/versions1.1.5Source reference:
/affected/0/versions1.1.3Source reference:
/affected/0/versions1.1.2Source reference:
/affected/0/versions1.1.1Source reference:
/affected/0/versions1.1.0Source reference:
/affected/0/versions1.0.2Source reference:
/affected/0/versions1.0.1Source reference:
/affected/0/versions1.0.0Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"package": {
"name": "homestack-cheer",
"purl": "pkg:npm/homestack-cheer",
"ecosystem": "npm"
},
"versions": [
"1.1.9",
"1.1.8",
"1.1.7",
"1.1.6",
"1.1.5",
"1.1.3",
"1.1.2",
"1.1.1",
"1.1.0",
"1.0.2",
"1.0.1",
"1.0.0"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/homestack-cheer/MAL-2026-16333.json",
"indicators": {
"evidence_files": [
{
"path": "src/index.js",
"tlsh": "3a14e0a555c55ad769e9ce0954d8652c9b383e8330718c9cfb6e39cf8f2aee420b043d",
"sha256": "619d23734e3b0bca92f3aa7fcb39f2a28ade4f7fa8d3cda03f50a4e2ffa9bac6"
},
{
"path": "src/env_load.js",
"tlsh": "410449184f433d72dfa047013bed35d9261d938e20a110cead2e698a6319beb75f16bd",
"sha256": "230125800baf6cba52ba03ab9aa73706237836768b044553822fbf4614a846a9"
},
{
"path": "package.json",
"tlsh": "83e02628db309c2314c841948de74203a7a04c6b8088bc1d3bd3011c464d7b344fd96d",
"sha256": "c0be25987c2961a05d540f0a67daf667991ac3e688053549de7365a07ef0ce7e"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "99c88fd898ce48869eaece5303b6d0f67766e290",
"sha512_sri": "sha512-H7Ejg7Fca9MRzl1k5y3bCdR423zte3QndAXwRhfflvKfQuXiErhrJmKU1ZMjdxL1flBluF6L3wEELWjAO6sdaQ=="
},
"filename": "homestack-cheer-1.1.9.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #65219 · Revision 1
- Added to Heist Feed
- Publisher date