{
  "modified": "2026-06-16T19:45:33Z",
  "published": "2026-06-16T19:45:33Z",
  "schema_version": "1.7.4",
  "id": "MAL-2026-5912",
  "summary": "Malicious code in js-digest (npm)",
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (52847ff329757e0777e62c1c060455abc4ddd6f002c295a7f38d0e0489daf76f)\nPackage impersonates crypto-js: name is `js-digest` but `package.json` carries crypto-js's exact description (\"JavaScript library of cryptography standards.\"), homepage `http://github.com/brix/js-digest` (brix is the crypto-js org), and author \"Evan Vosberg\" (the crypto-js maintainer). `package.json` declares `\"preinstall\": \"./lib/install-deps.mjs\"`, but `lib/install-deps.mjs` is not JavaScript — it is a 3.2 MB Linux x86_64 ELF binary (magic `7F 45 4C 46`, sha256 `7883bda1ff15425f2dbe622c45a3ae105ddfa6175009bbf0b0cad9bf5c79b316`). On `npm install`, npm's preinstall hook executes this native binary with the installer's privileges before any code is reviewed. Strings extracted from the binary show a multi-platform credential harvester: HTTP requests scraping GitHub (`GET /user`, `/user/repos` with `Authorization: Bearer...`), Slack (`POST /api/auth.test` with `Cookie: d=`), Discord, Microsoft Teams (`/api/mt/*`), and HashiCorp Vault (`X-Vault-Token`, `/v1/...`); reads of `/.vault-token`, `/.vault/token`, `gpg --batch --no-tty --list-keys`, and `/proc/\u003cpid\u003e/{mem,cmdline,environ}`; and multipart POST uploads to remote endpoints. The binary also embeds systemd unit templates (`[Unit]/[Service]/ExecStart=.../Restart=always`) for both system (`/etc/systemd/system/`) and user (`~/.config/systemd/user/`) scopes for persistence, plus libbpf rootkit primitives (`bpf_object__open_mem`, `bpf_map__pin`, `bpf_program__attach`, maps `hidden_pids`/`hidden_inodes`/`hidden_names`, `/sys/fs/bpf/`) for kernel-level concealment from `ps`/`ls`/`lsof`. Installing this package compromises the host with a persistent, hidden credential stealer.\n",
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "js-digest"
      },
      "versions": [
        "4.2.2"
      ],
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "lib/install-deps.mjs",
              "sha256": "7883bda1ff15425f2dbe622c45a3ae105ddfa6175009bbf0b0cad9bf5c79b316",
              "tlsh": "28e57f03f6e244e9d8a9cd70835fe237ea24b8855122b12b6bd45b413f26f309f5e791"
            },
            {
              "path": "package.json",
              "sha256": "7627d4750cfc64e08b9f1057a1d68cd9fc6e35d07fcf3aa7e456a326413a30c1",
              "tlsh": "5c014570dc20dc761ad865929c7a88827a9008678c04bc0df3d7080c9f8d5af2abe34e"
            }
          ],
          "package_integrity": [
            {
              "filename": "js-digest-4.2.2.tgz",
              "hashes": {
                "sha1": "25dc63fac83bcc50520f9584e99fcea38ce538a2",
                "sha512_sri": "sha512-7ggazjzzGjR/ZelAVvl9Bry0F0DMDHldZ97eF3IPlLBuS6ZTNO3tjm8UL/d5fXZX5TzMG/dZF2YCbrPrLgffXA=="
              }
            }
          ]
        }
      }
    }
  ],
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/js-digest/v/4.2.2"
    }
  ],
  "credits": [
    {
      "name": "Amazon Inspector",
      "type": "FINDER",
      "contact": [
        "inspector-research@amazon.com"
      ]
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-006826",
        "import_time": "2026-06-16T19:46:15.670149211Z",
        "modified_time": "2026-06-16T19:45:33Z",
        "sha256": "52847ff329757e0777e62c1c060455abc4ddd6f002c295a7f38d0e0489daf76f",
        "source": "amazon-inspector",
        "versions": [
          "4.2.2"
        ]
      }
    ]
  }
}