{"id":"MAL-2026-14367","summary":"Malicious code in @syncraft-labs/core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0efe219063a966d0d2025d6c3274cbc7e9f3c0b3a1e9cdf81c7adf6dbae4d4ac)\nThe ESM build shipped at dist/index.js contains a heavily obfuscated payload (hex-identifier string-array + rotator produced by an obfuscator.io-style tool) injected into the body of isDevMode(), which executes on every `import`/`require` of the package. The injected loader captures Node internals onto globalThis (globalThis.r = require, globalThis.m = module, globalThis.i = \"A12-synd\"), then uses http/https to query Ethereum JSON-RPC endpoints (eth.drpc.org, ethereum-rpc.publicnode.com, eth-mainnet.public.blockscout.com) and an Etherscan-style txlist API for a hardcoded attacker address (0xa322E5f3...), decodes and zlib-decompresses payload bytes from transaction data, and executes them via child_process.spawn. The CJS build of the same source is clean, indicating a targeted injection into the ESM entry rather than a bundler artifact. Any process importing this package fetches attacker-controlled code from a mutable on-chain dead-drop and runs it, giving the publisher arbitrary remote code execution on the installer's host with full Node capability handed to the second stage via the globalThis handoff.\n","modified":"2026-08-23T03:30:18.817831161Z","published":"2026-08-23T03:14:49Z","database_specific":{"malicious-packages-origins":[{"sha256":"0efe219063a966d0d2025d6c3274cbc7e9f3c0b3a1e9cdf81c7adf6dbae4d4ac","source":"amazon-inspector","versions":["0.4.1"],"id":"IN-MAL-2026-018570","import_time":"2026-08-23T03:25:56.301624897Z","modified_time":"2026-08-23T03:14:49Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@syncraft-labs/core/v/0.4.1"}],"affected":[{"package":{"name":"@syncraft-labs/core","ecosystem":"npm","purl":"pkg:npm/%40syncraft-labs/core"},"versions":["0.4.1"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"hashes":{"sha1":"b9f80df0c368f86334f88ff20137b4d9a87bbe93","sha512_sri":"sha512-whxdtQ6Ods1/heyf6n8R6witY6f8TbWmpocFUANSg6c5P8R5eGLGLq36pN/dKTMkMjU/TDHw7MAbn9Wd9Brc3A=="},"filename":"core-0.4.1.tgz"}],"evidence_files":[{"path":"dist/index.js","sha256":"74b62f6749b85c9951deb65d0119c1f5a150f3db53722f2244b25fda8fe3a05b","tlsh":"f843a4c4a6f22450434376bf7b1fa0e5fa29089f3548ce85f60cba44ef5622ad5f1a74"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@syncraft-labs/core/MAL-2026-14367.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}