MAL-2026-14347

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/mcq-session/MAL-2026-14347.json
JSON Data
https://api.test.osv.dev/v1/vulns/MAL-2026-14347
Published
2026-08-21T04:21:28Z
Modified
2026-08-21T05:01:52.388369868Z
Summary
Malicious code in mcq-session (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (1acf694ae0258defc54c414980c5f8512b7055e69630ede15a8bfb37d2005b9b)

On any require()/import of mcq-session, the main module runs a top-level async IIFE that reads a file at../../../../public/logo.ico (a path escaping the package root into a host application's public assets), DES-decrypts the bytes with a hardcoded password 'bf497c0b9cee' using multiple CryptoJS decode formats, and pipes the decrypted plaintext into a detached, unref'd 'node' subprocess via stdin. The decrypted content is treated as executable JavaScript with no signature check, integrity verification, or user gate. The loader is disguised behind cover-story identifiers ('readLogoIco', 'ThetaSDK initialization'). The symmetric key ships alongside the loader, so the encryption serves only to defeat static inspection of the staged payload. The out-of-package path indicates the payload is dropped separately alongside a host application, making the on-disk blob attacker-controlled from the installer's perspective.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-018498",
            "versions": [
                "1.0.4"
            ],
            "modified_time": "2026-08-21T04:21:28Z",
            "sha256": "1acf694ae0258defc54c414980c5f8512b7055e69630ede15a8bfb37d2005b9b",
            "import_time": "2026-08-21T04:48:53.341858767Z",
            "source": "amazon-inspector"
        },
        {
            "id": "IN-MAL-2026-018499",
            "sha256": "fe84a62bd4f46ea4176c612c777b12e5e0887596f69d69bfa91c2fcec43e08a6",
            "modified_time": "2026-08-21T04:21:37Z",
            "versions": [
                "1.0.3"
            ],
            "import_time": "2026-08-21T04:48:53.386731619Z",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / mcq-session

Package

Name
mcq-session
View open source insights on deps.dev
Purl
pkg:npm/mcq-session

Affected ranges

Affected versions

1.*
1.0.3
1.0.4

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "506388a1987e85f27591742a70b35b4ce54a8c5d3db48fb53e16a6807f1cdb1b",
            "path": "src/api/session-api.js",
            "tlsh": "d4c1f15c2c03e12757f0e3bd4e32c454eb735a913b119aa1faac77a12f994d06532ed8"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-kOEO+ILaWj6SwSgGMMlRjjiGtuEWlc3t9x+k0WefuvIg1CGJe4FxPkZuXY6t3Md+HQFC2FIk0ifCTMnY9dWhkg==",
                "sha1": "243e9dc07bdd7e6f225f374dc14483dd00fe9dc6"
            },
            "filename": "mcq-session-1.0.4.tgz"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/mcq-session/MAL-2026-14347.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]