MAL-2026-14367

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@syncraft-labs/core/MAL-2026-14367.json
JSON Data
https://api.test.osv.dev/v1/vulns/MAL-2026-14367
Published
2026-08-23T03:14:49Z
Modified
2026-08-23T03:30:18.817831161Z
Summary
Malicious code in @syncraft-labs/core (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0efe219063a966d0d2025d6c3274cbc7e9f3c0b3a1e9cdf81c7adf6dbae4d4ac)

The ESM build shipped at dist/index.js contains a heavily obfuscated payload (hex-identifier string-array + rotator produced by an obfuscator.io-style tool) injected into the body of isDevMode(), which executes on every import/require of the package. The injected loader captures Node internals onto globalThis (globalThis.r = require, globalThis.m = module, globalThis.i = "A12-synd"), then uses http/https to query Ethereum JSON-RPC endpoints (eth.drpc.org, ethereum-rpc.publicnode.com, eth-mainnet.public.blockscout.com) and an Etherscan-style txlist API for a hardcoded attacker address (0xa322E5f3...), decodes and zlib-decompresses payload bytes from transaction data, and executes them via child_process.spawn. The CJS build of the same source is clean, indicating a targeted injection into the ESM entry rather than a bundler artifact. Any process importing this package fetches attacker-controlled code from a mutable on-chain dead-drop and runs it, giving the publisher arbitrary remote code execution on the installer's host with full Node capability handed to the second stage via the globalThis handoff.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-018570",
            "sha256": "0efe219063a966d0d2025d6c3274cbc7e9f3c0b3a1e9cdf81c7adf6dbae4d4ac",
            "modified_time": "2026-08-23T03:14:49Z",
            "versions": [
                "0.4.1"
            ],
            "import_time": "2026-08-23T03:25:56.301624897Z",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / @syncraft-labs/core

Package

Name
@syncraft-labs/core
View open source insights on deps.dev
Purl
pkg:npm/%40syncraft-labs/core

Affected ranges

Affected versions

0.*
0.4.1

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "74b62f6749b85c9951deb65d0119c1f5a150f3db53722f2244b25fda8fe3a05b",
            "path": "dist/index.js",
            "tlsh": "f843a4c4a6f22450434376bf7b1fa0e5fa29089f3548ce85f60cba44ef5622ad5f1a74"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-whxdtQ6Ods1/heyf6n8R6witY6f8TbWmpocFUANSg6c5P8R5eGLGLq36pN/dKTMkMjU/TDHw7MAbn9Wd9Brc3A==",
                "sha1": "b9f80df0c368f86334f88ff20137b4d9a87bbe93"
            },
            "filename": "core-0.4.1.tgz"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@syncraft-labs/core/MAL-2026-14367.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]