Skip to content
Heist/ feed
Unrated

Malicious code in homestack-cheer (npm)

Type: advisorySource: OSV1 source record

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f475cd8b8a3e1dd4563ca0b20d85fde83576ed78c27eb91ca1cd77fbebe0d142) The package is published as homestack-cheer with description 'JS lib support cheerleading', but the README and the UMD build (dist/my-lib.umd.js) present it as a trivial hello-world 'greet' library. The ESM entrypoint declared in package.json 'module' (src/index.js) and src/env_load.js each end with `new Function(atob('<~180KB base64>')).call(this)`, decoding an obfuscated second-stage payload via a runtime string-shuffle routine. When a downstream project bundles this package with webpack/rollup, the ESM path is resolved and the hidden payload is embedded into the resulting application bundle and executed in end-users' browsers. The decoded payload checks `window.location` for the substring 'checkout' and, when a Stripe payment element iframe (#stripe-payment-element iframe) is present, hides the real Stripe iframe, clears the disabled state on the place-order button, and injects a look-alike iframe with id `__privateStripeFrame84331` to intercept card input. The divergence between the benign `main` (UMD greet) and the malicious `module` (ESM Function(atob(...))) constitutes deliberate dual-entrypoint smuggling designed to evade casual review of the package's headline file. ## Source: ghsa-malware (b0622f60729e4dec05a0c9f802b4728a7c579d968532a87d664b759da856ad27) Any computer that has this package installed or running shou

Announced Source revision 1
Original source ↗

MAL-2026-16333

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:MAL-2026-16333

homestack-cheer

Source reference: /affected/0/package/name

Affected versions
1.1.9

Source reference: /affected/0/versions

1.1.8

Source reference: /affected/0/versions

1.1.7

Source reference: /affected/0/versions

1.1.6

Source reference: /affected/0/versions

1.1.5

Source reference: /affected/0/versions

1.1.3

Source reference: /affected/0/versions

1.1.2

Source reference: /affected/0/versions

1.1.1

Source reference: /affected/0/versions

1.1.0

Source reference: /affected/0/versions

1.0.2

Source reference: /affected/0/versions

1.0.1

Source reference: /affected/0/versions

1.0.0

Source reference: /affected/0/versions

Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "package": {
      "name": "homestack-cheer",
      "purl": "pkg:npm/homestack-cheer",
      "ecosystem": "npm"
    },
    "versions": [
      "1.1.9",
      "1.1.8",
      "1.1.7",
      "1.1.6",
      "1.1.5",
      "1.1.3",
      "1.1.2",
      "1.1.1",
      "1.1.0",
      "1.0.2",
      "1.0.1",
      "1.0.0"
    ],
    "database_specific": {
      "cwes": [
        {
          "name": "Embedded Malicious Code",
          "cweId": "CWE-506",
          "description": "The product contains code that appears to be malicious in nature."
        },
        {
          "name": "Embedded Malicious Code",
          "cweId": "CWE-506",
          "description": "The product contains code that appears to be malicious in nature."
        }
      ],
      "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/homestack-cheer/MAL-2026-16333.json",
      "indicators": {
        "evidence_files": [
          {
            "path": "src/index.js",
            "tlsh": "3a14e0a555c55ad769e9ce0954d8652c9b383e8330718c9cfb6e39cf8f2aee420b043d",
            "sha256": "619d23734e3b0bca92f3aa7fcb39f2a28ade4f7fa8d3cda03f50a4e2ffa9bac6"
          },
          {
            "path": "src/env_load.js",
            "tlsh": "410449184f433d72dfa047013bed35d9261d938e20a110cead2e698a6319beb75f16bd",
            "sha256": "230125800baf6cba52ba03ab9aa73706237836768b044553822fbf4614a846a9"
          },
          {
            "path": "package.json",
            "tlsh": "83e02628db309c2314c841948de74203a7a04c6b8088bc1d3bd3011c464d7b344fd96d",
            "sha256": "c0be25987c2961a05d540f0a67daf667991ac3e688053549de7365a07ef0ce7e"
          }
        ],
        "package_integrity": [
          {
            "hashes": {
              "sha1": "99c88fd898ce48869eaece5303b6d0f67766e290",
              "sha512_sri": "sha512-H7Ejg7Fca9MRzl1k5y3bCdR423zte3QndAXwRhfflvKfQuXiErhrJmKU1ZMjdxL1flBluF6L3wEELWjAO6sdaQ=="
            },
            "filename": "homestack-cheer-1.1.9.tgz"
          }
        ]
      }
    }
  }
]

Publisher severity

No explicit severity was provided.

Event
#65219 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement