{"id":"MAL-2026-14265","summary":"Malicious code in easydsbots (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6c3ee114e4ac67d2d02a9668c7ed0b38cbf62f9bc59e35b92c0ff9e713d3a688)\npackage.json declares `\"postinstall\": \"sudo node install.js\"`, escalating to root on `npm install`. install.js is heavily obfuscated (obfuscator.io: rotated 140-entry string array `a0_0xdc68`, hex-encoded property lookups, control-flow flattening, self-defending stubs) so the executed behavior is deliberately hidden from installers. index.js is similarly obfuscated (rotated 164-entry string array `a0_0x53d8`, runtime base64 decoding via `Buffer[...](ertrf,...).toString()`), declares `js-virtualizer` as a runtime dependency, and reads `process.env.INVOCATION_ID` into an `isRunningAsService` flag — an environment variable set only when a process is launched by systemd. The package also depends on `node-linux`, a library that registers /etc/init.d or systemd unit files. The combination — root-level lifecycle hook, opaque payload, systemd-context branch, and a daemon-installer dependency — is the shape of an obfuscated root-persistent daemon dropper executed at install time on the installer's host.\n","modified":"2026-08-19T07:00:15.490030073Z","published":"2026-08-19T06:28:27Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-19T06:49:44.442807323Z","modified_time":"2026-08-19T06:28:27Z","sha256":"6c3ee114e4ac67d2d02a9668c7ed0b38cbf62f9bc59e35b92c0ff9e713d3a688","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-018382"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/easydsbots/v/1.0.0"}],"affected":[{"package":{"name":"easydsbots","ecosystem":"npm","purl":"pkg:npm/easydsbots"},"versions":["1.0.0"],"database_specific":{"indicators":{"evidence_files":[{"tlsh":"5de07d040c219b7325c199d85c23108bbf8b0714420884040397514453ed7bf04bf70a","path":"package.json","sha256":"5c7fb57281a7c9b072e73456826c3bc1eac9e6ededd6f4c47272fc0595a360b8"},{"tlsh":"1303dec477c1f843228f4f737b16b6f5e12a4c9671c8248bf108bd98f9a9516e6a0db1","path":"index.js","sha256":"afd29f259cf6db93f45778b360d4552da1fc7aedea88869246039ec6e6e010bf"}],"package_integrity":[{"filename":"easydsbots-1.0.0.tgz","hashes":{"sha1":"65faab96a543a5acf2ee77aa5b28ee21002843be","sha512_sri":"sha512-hwjlUxKPc+EyzJObdBgSTkLdQpkeKIkQZk7OQLvFfFp6TTz0AemmpDHRmKSO1iu6YixKFfz28UZCVrBBfiIsZQ=="}}]},"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/easydsbots/MAL-2026-14265.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}