Malicious code in imgbundle (npm)

{
  "id": "7f0921fef3c059e555988c9ef48478cd643da0875d5051160903118d9cd3b1d3",
  "url": "https://osv.dev/vulnerability/MAL-2026-17330",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Malicious code in imgbundle (npm)",
    "summary": "--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (e14218599b46d143fa8e150156864d14d58c327bd8a8816221ac4e8c5cc99350) The package advertises itself as an image bundler, but index.js performs no image bundling. On require, a top-level IIFE reads an AES-256-CBC-encrypted file at `cdn-img-fetch/.cache/banner.jpg` inside the sibling dependency `cdn-img-fetch`, decrypts it with a hardcoded key derived from `sha256('nif-runtime-2027')`, writes the plaintext to `cdn-img-fetch/.runtime/rt.jpg`, deletes the source file, and registers an `fs.watch` on the source directory so the decrypt-and-stage step still fires if the encrypted blob is delivered later. The package also calls `cif.ensureCached()` on the `cdn-img-fetch` dependency in an error-recovery path, wiring the two packages together as a coordinated staged dropper: `cdn-img-fetch` supplies the encrypted bytes and `imgbundle` acts as the decoder that materializes attacker-controlled content onto the installer's filesystem at import time. The README description of image bundling does not correspond to any code path in the module, and hardcoded-AES-key decryption of an opaque blob from another package is not a legitimate implementation of that stated purpose. ## Source: ghsa-malware (6175161f6fa075711e55b1f0db7d346357ce5593b1e3b48fc30cd85aaad81576) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should b",
    "evidence": "osv:MAL-2026-17330",
    "products": [
      {
        "name": {
          "value": "imgbundle",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "1.0.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.0.1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "1.0.2",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "MAL-2026-17330",
      "aliases": [
        "GHSA-hj6h-6xgx-mpjv",
        "MAL-2026-17330"
      ],
      "affected": [
        {
          "package": {
            "name": "imgbundle",
            "purl": "pkg:npm/imgbundle",
            "ecosystem": "npm"
          },
          "versions": [
            "1.0.0",
            "1.0.1",
            "1.0.2"
          ],
          "database_specific": {
            "cwes": [
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              }
            ],
            "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/imgbundle/MAL-2026-17330.json",
            "indicators": {
              "evidence_files": [
                {
                  "path": "index.js",
                  "tlsh": "3f31234219f533354673a2eeaa6b5c8e21a3d6933316d948f6cc0dc60fb30348a325ad",
                  "sha256": "081029d14ba1ddcdf8bee99e82bc3cc6b2fb1a19302532ca425e3c343934ed09"
                }
              ],
              "package_integrity": [
                {
                  "hashes": {
                    "sha1": "5aa1a891215f673f4ac2761bf16b5c99ee9d13a0",
                    "sha512_sri": "sha512-v3XFGqCPkNOSyjEOD4Fz7AZpR93UmwTB73xpKIp8oPf3WGunhVPNqq/4GI3Sppe7hEd8fbc7wEr5ng8NHTlyww=="
                  },
                  "filename": "imgbundle-1.0.0.tgz"
                }
              ]
            }
          }
        }
      ],
      "modified": "2026-10-07T23:30:04.705618979Z",
      "provider": "osv",
      "references": [
        "https://www.npmjs.com/package/imgbundle/v/1.0.0",
        "https://www.npmjs.com/package/imgbundle/v/1.0.1",
        "https://github.com/advisories/GHSA-hj6h-6xgx-mpjv"
      ],
      "provider_metadata": {
        "malicious-packages-origins": [
          {
            "id": "IN-MAL-2026-020810",
            "sha256": "1577a61d49bcd6bd941dc6901b176730252973766b198f2065baea643ca81a16",
            "source": "amazon-inspector",
            "versions": [
              "1.0.0"
            ],
            "import_time": "2026-09-30T05:19:45.839423747Z",
            "modified_time": "2026-09-30T04:50:22Z"
          },
          {
            "id": "IN-MAL-2026-020809",
            "sha256": "e14218599b46d143fa8e150156864d14d58c327bd8a8816221ac4e8c5cc99350",
            "source": "amazon-inspector",
            "versions": [
              "1.0.1"
            ],
            "import_time": "2026-09-30T05:19:45.75035256Z",
            "modified_time": "2026-09-30T04:50:10Z"
          },
          {
            "id": "GHSA-hj6h-6xgx-mpjv",
            "sha256": "6175161f6fa075711e55b1f0db7d346357ce5593b1e3b48fc30cd85aaad81576",
            "source": "ghsa-malware",
            "versions": [
              "1.0.2",
              "1.0.1",
              "1.0.0"
            ],
            "import_time": "2026-10-07T23:23:59.761879446Z",
            "modified_time": "2026-10-07T23:06:15Z"
          }
        ]
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 98220,
  "published_at": "2026-09-30T04:50:10+00:00"
}