Malicious code in items-validator (npm)

{
  "id": "b61701b280fdf83cd2f91284685912b25a9b854e4c3217a01583793b2442e909",
  "url": "https://osv.dev/vulnerability/MAL-2026-17235",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Malicious code in items-validator (npm)",
    "summary": "--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (a8e49b1abd7c566b17104c5a2823251df2ca253a0fa509d7c19db1c1942ad13d) On require, index.js invokes initializeDaemon() at top level, which uses spawn('node', [lib/check-items.js], { detached: true, stdio: 'ignore' }) followed by child.unref() to launch a persistent background process independent of the parent. The daemon HTTP-GETs a JSON payload from the hardcoded endpoint https://game.spawnrealm.com/api/item-realtime?key=abcdef123456 and passes payload.code to `new Function('require', 'module', payload.code)`, executing server-supplied JavaScript inside the installer's Node process with full `require` access. An RSA signature check is performed against a public key bundled in the package (crypto-config.js), so the author controls both the signing key and the verifier and the check provides no independent integrity guarantee. Anyone controlling game.spawnrealm.com — including via DNS or TLS — can run arbitrary code as the installing user for the lifetime of the host process. The package is advertised as a validator library, and this remote-code-loader behavior is undisclosed and unrelated to the stated purpose. ## Source: ghsa-malware (4d7809ec0ad9a22799a0cb4757d4001d12da258f174da823708c5b3747b33d56) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer",
    "evidence": "osv:MAL-2026-17235",
    "products": [
      {
        "name": {
          "value": "items-validator",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "1.0.5",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.0.4",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "MAL-2026-17235",
      "aliases": [
        "GHSA-rpgc-c7g7-g8fh",
        "MAL-2026-17235"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                }
              ]
            }
          ],
          "package": {
            "name": "items-validator",
            "purl": "pkg:npm/items-validator",
            "ecosystem": "npm"
          },
          "versions": [
            "1.0.5",
            "1.0.4"
          ],
          "database_specific": {
            "cwes": [
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              }
            ],
            "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/items-validator/MAL-2026-17235.json",
            "indicators": {
              "evidence_files": [
                {
                  "path": "lib/check-items.js",
                  "tlsh": "08a1768ead4b92371eb642f44317602afb5e91832790d255bbcdd34c2fb811c9325cea",
                  "sha256": "ec1f4da780fb3263d71ea555f4bcbdfd8416e98611bd1ad29f3cc053cb8840ba"
                },
                {
                  "path": "index.js",
                  "tlsh": "1a11e1e636daa5667c72afe1e9378111be16c11277004011b8edbad70fe19864353cbd",
                  "sha256": "32985404eebe9f1ff6887d25b383a152b58522fd8b102385269501d3aa8e29cf"
                }
              ],
              "package_integrity": [
                {
                  "hashes": {
                    "sha1": "5ec9999b56678b98ee984478b8c30c95fb477506",
                    "sha512_sri": "sha512-OTCjY7h3uNpCdIi1nFWcLipqLzc9Cc0stz5EV1bcKuHrerrlVrvDfyQ4DdCUBaU2u0fs8oDBVxaT1Zr+WBF4Jw=="
                  },
                  "filename": "items-validator-1.0.5.tgz"
                }
              ]
            }
          }
        }
      ],
      "modified": "2026-10-19T17:34:26.339245177Z",
      "provider": "osv",
      "references": [
        "https://www.npmjs.com/package/items-validator/v/1.0.5",
        "https://www.npmjs.com/package/items-validator/v/1.0.4",
        "https://github.com/advisories/GHSA-rpgc-c7g7-g8fh"
      ],
      "provider_metadata": {
        "malicious-packages-origins": [
          {
            "id": "IN-MAL-2026-020612",
            "sha256": "a8e49b1abd7c566b17104c5a2823251df2ca253a0fa509d7c19db1c1942ad13d",
            "source": "amazon-inspector",
            "versions": [
              "1.0.5"
            ],
            "import_time": "2026-09-28T22:18:22.617475759Z",
            "modified_time": "2026-09-28T22:03:57Z"
          },
          {
            "id": "IN-MAL-2026-020815",
            "sha256": "c62ac19c22ce386930961b0a6c096a395dcedb4249eb09459ea98f693dec974b",
            "source": "amazon-inspector",
            "versions": [
              "1.0.4"
            ],
            "import_time": "2026-09-30T05:19:46.36959615Z",
            "modified_time": "2026-09-30T05:04:34Z"
          },
          {
            "id": "GHSA-rpgc-c7g7-g8fh",
            "ranges": [
              {
                "type": "SEMVER",
                "events": [
                  {
                    "introduced": "0"
                  }
                ]
              }
            ],
            "sha256": "4d7809ec0ad9a22799a0cb4757d4001d12da258f174da823708c5b3747b33d56",
            "source": "ghsa-malware",
            "import_time": "2026-10-19T06:51:38.187886771Z",
            "modified_time": "2026-10-19T06:25:32Z"
          }
        ]
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 375541,
  "published_at": "2026-09-28T22:03:57+00:00"
}