Malicious code in clickfix_npm_delivery (npm)

{
  "id": "5e01b2c8129e9379023b3d030ebf9f937dedce767d740602a7c227263def9439",
  "url": "https://osv.dev/vulnerability/MAL-2026-17692",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Malicious code in clickfix_npm_delivery (npm)",
    "summary": "--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f795362044848bcb73d95317e8761c4315720d6a052c6c88fdab47065499510d) The package has no library surface. `package.json` declares `main: index.html` and the tarball ships only that HTML page, whose sole purpose is a ClickFix social-engineering lure. The page impersonates Cloudflare Turnstile (Cloudflare branding, a spoofed `dash.cloudflare.com` header, a fake 'Verify you are human' checkbox, and a fake 'Ray ID / 403 Forbidden' bot-detection screen). When the victim clicks the fake checkbox, the page silently writes a PowerShell one-liner to the clipboard and instructs the victim to press Win+R, paste, and hit Enter. The clipboard payload uses `Start-BitsTransfer` to download a script from `http://ec2-65-2-4-62.ap-south-1.compute.amazonaws.com:443/script` over plain HTTP into `$env:temp\\sys.ps1` and executes it via `iex (gc $t -Raw)`, giving the operator of that EC2 host arbitrary code execution on the victim's Windows machine. The package name (`clickfix_npm_delivery`) and description ('Delivery POC Package') identify npm itself as the distribution channel for the lure. ## Source: ghsa-malware (a92eb0e7964a67df5bb46bd87559b74f949ee053811eb36679aad4d42342f8f3) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as f",
    "evidence": "osv:MAL-2026-17692",
    "products": [
      {
        "name": {
          "value": "clickfix_npm_delivery",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "1.0.2",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.0.0",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "MAL-2026-17692",
      "aliases": [
        "GHSA-37h8-m54m-784j",
        "MAL-2026-17692"
      ],
      "affected": [
        {
          "package": {
            "name": "clickfix_npm_delivery",
            "purl": "pkg:npm/clickfix_npm_delivery",
            "ecosystem": "npm"
          },
          "versions": [
            "1.0.2",
            "1.0.0"
          ],
          "database_specific": {
            "cwes": [
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              }
            ],
            "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/clickfix_npm_delivery/MAL-2026-17692.json",
            "indicators": {
              "evidence_files": [
                {
                  "path": "index.html",
                  "tlsh": "04c2635b26b710517913a0a56be74b563230d003c44acd793fed938d8f8aad5e9a37cc",
                  "sha256": "f15e0ffa14569bb5f2c473c823686836d5f8de8d8188ff5911ac6639d01c03c1"
                },
                {
                  "path": "package.json",
                  "tlsh": "d9d0a7184981612300d80a15097c74167621ce1b0154380e8b83202896ef66314b970e",
                  "sha256": "d2c78e16bb11dd0bc157d22762b74c3be15c4c943eac6da1b25ea3ec2143f9d7"
                }
              ]
            }
          }
        }
      ],
      "modified": "2026-10-08T20:30:04.713644622Z",
      "provider": "osv",
      "references": [
        "https://github.com/advisories/GHSA-37h8-m54m-784j",
        "https://www.npmjs.com/package/clickfix_npm_delivery/v/1.0.2"
      ],
      "provider_metadata": {
        "malicious-packages-origins": [
          {
            "id": "GHSA-37h8-m54m-784j",
            "sha256": "a92eb0e7964a67df5bb46bd87559b74f949ee053811eb36679aad4d42342f8f3",
            "source": "ghsa-malware",
            "versions": [
              "1.0.2",
              "1.0.0"
            ],
            "import_time": "2026-10-08T16:32:56.827315821Z",
            "modified_time": "2026-10-08T16:25:07Z"
          },
          {
            "id": "IN-MAL-2026-021234",
            "sha256": "f795362044848bcb73d95317e8761c4315720d6a052c6c88fdab47065499510d",
            "source": "amazon-inspector",
            "versions": [
              "1.0.2"
            ],
            "import_time": "2026-10-08T20:20:20.409040666Z",
            "modified_time": "2026-10-08T20:08:25Z"
          }
        ]
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 104576,
  "published_at": "2026-10-08T16:25:06+00:00"
}