Malicious code in @subql/common (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f636fe7b88ce4be7e029a7685f097fe9dc65090b919906ddf0368a3c07a3464a) package.json declares a postinstall hook `node./dist/project/readers/manifest-cache.js`. That file embeds ~60KB of base64 chunks under `MANIFEST_CACHE_SEED` and a custom `decodeManifestSeed` routine that XOR-unmasks the bytes with 0x5a and `zlib.gunzipSync`s the result. When the file runs as main (`require.main === module`), the decoded string is passed to `new Function(decodeManifestSeed())(__filename, [...])`, yielding arbitrary code execution on every `npm install` with no signature, no network pin, and no human-readable payload. The shipped source map's `sourcesContent` for manifest-cache.js ends at a benign `ManifestCacheReader` class and does not contain the top-level `require.main === module` dispatcher that appears in the compiled JS, indicating the source map was scrubbed to hide the loader from source-level review. The dropper is also reachable at runtime through the package's public API: `dist/index.js` re-exports `./project`, which re-exports `./manifest-cache`, and `ManifestCacheReader.warm()` spawns a detached `node __filename --warm` subprocess that re-enters the main-mode decode-and-eval branch outside the parent process lifecycle. ## Source: ghsa-malware (f61412a3cec35a73a5b37775eec9289fff4eaca86da7ae85060fb9f6989ab2a8) Any computer that has this package installed or running should be considered fully compr
MAL-2026-17571
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-17571
@subql/common
Source reference: /affected/0/package/name
- Affected versions
- 5.8.3
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"package": {
"name": "@subql/common",
"purl": "pkg:npm/%40subql/common",
"ecosystem": "npm"
},
"versions": [
"5.8.3"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@subql/common/MAL-2026-17571.json",
"indicators": {
"evidence_files": [
{
"path": "dist/project/readers/manifest-cache.js",
"tlsh": "a553f1764c37be872664e84b022fc401adacd8074da5be25f5adc6755fcda0e90788b3",
"sha256": "f0c8b0cde86b98a2869a22fd43ffcf61f1dcca252729e2be291e590e3dc5f49a"
},
{
"path": "dist/project/readers/manifest-cache.js.map",
"tlsh": "5f41560366e865314a10cfc8cbfe47167f69b10456296078fe5db49723ab424c37e4ba",
"sha256": "3e05100860e876377c16524a4d3ccdea897f86391720a5988d123ed442ce2145"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "6c1d21306a767fb0d7af24c46b0f6010b2b6bee6",
"sha512_sri": "sha512-ofnAPv45o0C5Jo5PS6Z+rl0swJHpO/XfCU8UBj44yRhDHwOn0l6WWTuv/Q//CFOhQtvdSmLuouOXlKb2TItHsg=="
},
"filename": "common-5.8.3.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #84297 · Revision 1
- Added to Heist Feed
- Publisher date