Malicious code in async-mutex-hook (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (624c93cbd007656467757c5504db29971b220bc36685eda2af6a1d1390715133) Package is published under the name async-mutex-hook and self-describes as a Promise-based mutex library, but ships no mutex implementation. Its exported getPlugin function issues an HTTPS request to the hardcoded bare-IP endpoint https://46.183.25.232:45000/icons/108 and passes the response's `credits` field to `new Function('require','module','exports',...,'Promise', data.credits)`, executing attacker-controlled JavaScript with full Node.js privileges (require, process, Buffer, and shipped dependencies injected). The declared dependencies (@primno/dpapi for Windows DPAPI, better-sqlite3/sqlite3 for browser cookie and login databases, node-machine-id) are unrelated to any mutex functionality and are the standard building blocks for browser-credential and DPAPI theft, matching the capability the remote payload would need to invoke on the installer's host.
MAL-2026-12339
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-12339
async-mutex-hook
Source reference: /affected/0/package/name
- Affected versions
- 2.1.0
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"package": {
"name": "async-mutex-hook",
"purl": "pkg:npm/async-mutex-hook",
"ecosystem": "npm"
},
"versions": [
"2.1.0"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/async-mutex-hook/MAL-2026-12339.json",
"indicators": {
"evidence_files": [
{
"path": "index.js",
"tlsh": "30c1616546fa31a36a67e4eef30f10027165e313365de971f48e42902fca568e5f24e8",
"sha256": "ce2c680ca6b7355d73cbc131465fc6b2f2508f367b57ecb27a3b05e6e247213f"
},
{
"path": "package.json",
"tlsh": "46f04911ce21deb314d615976828809aa150d91b8d00fc0c339e866d4f0e56f36fb26c",
"sha256": "3c35cd56d5f1c18ccd5452864e507aa31c239ec87b004b49d272577ff3f0ba83"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "38c760af73f28532e5f071265c441b3d2b753a52",
"sha512_sri": "sha512-j+XJiupEbofuKM1EDdkiVio2yzPClLFcVmiT09Skfg7TuB2mWW+iiM/cX248OrZs0yP3MLhHQdspgnX6EWM9mA=="
},
"filename": "async-mutex-hook-2.1.0.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #10956 · Revision 1
- Added to Heist Feed
- Publisher date