{"id":"MAL-2026-19142","kind":"package","aliases":["MAL-2026-19142"],"related":[],"title":"Malicious code in fcefi-wdojs-util (npm)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (07a00a17209ccc173a7196dd8e97486609819945db1459a5333463be9f6c20b9)\nfcefi-wdojs-util@1.0.0 ships a loader in index.js that reads an undeclared `_bz` numeric array (~1000 bytes) from its own package.json, zlib-inflates it, and executes the resulting JavaScript via the Function constructor on every require of the package. The loader is wrapped in an IIFE that explicitly short-circuits when any of `CI`, `GITHUB_ACTIONS`, `GITLAB_CI`, `TRAVIS`, `CIRCLECI`, or `SANDBOX` are set in the environment, so the payload only runs on developer and production hosts and stays inert in scanning environments. Adjacent to the loader, lib/native.pkg_config is a 2,890,302-byte file containing only hex characters with no printable strings and no relation to native code or pkg-config, consistent with an encrypted stage-2 payload decrypted by the inflated bytecode. The combination — executable code smuggled inside the manifest as a non-standard field, require-time Function()-based execution, deliberate CI/sandbox evasion, and a large opaque hex blob shipped as a misleadingly named config file — is a multi-stage dropper with no legitimate utility function.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"fcefi-wdojs-util","fixed":[],"affected":"= 1.0.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-11T21:01:46+00:00","first_seen_at":"2026-11-11T21:29:24+00:00","triaged_at":"2026-11-11T21:30:27+00:00","updated_at":"2026-11-11T21:31:13+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-19142':11A,14A '-2':157C '-2026':10A,13A '07a00a17209ccc173a7196dd8e97486609819945db1459a5333463be9f6c20b9':34C '1.0.0':39C '1000':52C '2':129C '302':131C '890':130C 'action':94C 'adjac':122C 'amazon':32C 'amazon-inspector':31C 'array':51C 'base':182C 'blob':192C 'byte':53C,132C 'bytecod':163C 'bz':49C 'charact':137C 'ci':92C,96C 'ci/sandbox':185C 'circleci':98C 'circuit':88C 'code':2A,147C,167C 'combin':165C 'config':151C,198C 'consist':152C 'constructor':70C 'contain':134C 'decrypt':159C 'deliber':184C 'detail':23C 'develop':112C 'dropper':205C 'edit':26C 'encrypt':155C 'environ':105C,121C 'evas':186C 'everi':72C 'execut':63C,166C,183C 'explicit':85C 'fcefi':5A,16A,36C 'fcefi-wdojs-util':4A,15A,35C 'field':177C 'file':133C,199C 'function':69C,181C,210C 'github':93C 'gitlab':95C 'hex':136C,191C 'host':115C 'iif':83C 'index.js':44C 'inert':118C 'inflat':60C,162C 'insid':169C 'inspector':33C 'javascript':66C 'larg':189C 'legitim':208C 'lib/native.pkg_config':126C 'line':29C 'loader':42C,78C,125C 'mal':9A,12A 'malici':1A,19B 'manifest':171C 'mislead':196C 'multi':203C 'multi-stag':202C 'name':197C 'nativ':146C 'non':175C 'non-standard':174C 'npm':8A 'numer':50C 'opaqu':190C 'packag':20B,76C 'package.json':57C 'payload':108C,158C 'per':21C 'pkg':150C 'pkg-config':149C 'printabl':140C 'product':114C 'read':46C 'relat':144C 'requir':73C,179C 'require-tim':178C 'result':65C 'run':110C 'sandbox':100C 'scan':120C 'set':102C 'ship':40C,193C 'short':87C 'short-circuit':86C 'smuggl':168C 'sourc':22C,30C 'stage':156C,204C 'standard':176C 'stay':117C 'string':141C 'time':180C 'travi':97C 'undeclar':48C 'util':7A,18A,38C,209C 'via':67C 'wdoj':6A,37C 'wdojs':17A 'wrap':80C 'zlib':59C 'zlib-infl':58C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["fcefiwdojsutil"],"ptokens":["fcefi","util","wdojs"],"labels":["critical","malicious","npm","package"],"campaign_type":null,"search_a":"'-19142':11A,14A '-2026':10A,13A 'code':2A 'fcefi':5A,16A 'fcefi-wdojs-util':4A,15A 'mal':9A,12A 'malici':1A 'npm':8A 'util':7A,18A 'wdoj':6A 'wdojs':17A","search_b":"'malici':19B 'packag':20B","search_c":"'-2':157C '07a00a17209ccc173a7196dd8e97486609819945db1459a5333463be9f6c20b9':34C '1.0.0':39C '1000':52C '2':129C '302':131C '890':130C 'action':94C 'adjac':122C 'amazon':32C 'amazon-inspector':31C 'array':51C 'base':182C 'blob':192C 'byte':53C,132C 'bytecod':163C 'bz':49C 'charact':137C 'ci':92C,96C 'ci/sandbox':185C 'circleci':98C 'circuit':88C 'code':147C,167C 'combin':165C 'config':151C,198C 'consist':152C 'constructor':70C 'contain':134C 'decrypt':159C 'deliber':184C 'detail':23C 'develop':112C 'dropper':205C 'edit':26C 'encrypt':155C 'environ':105C,121C 'evas':186C 'everi':72C 'execut':63C,166C,183C 'explicit':85C 'fcefi':36C 'fcefi-wdojs-util':35C 'field':177C 'file':133C,199C 'function':69C,181C,210C 'github':93C 'gitlab':95C 'hex':136C,191C 'host':115C 'iif':83C 'index.js':44C 'inert':118C 'inflat':60C,162C 'insid':169C 'inspector':33C 'javascript':66C 'larg':189C 'legitim':208C 'lib/native.pkg_config':126C 'line':29C 'loader':42C,78C,125C 'manifest':171C 'mislead':196C 'multi':203C 'multi-stag':202C 'name':197C 'nativ':146C 'non':175C 'non-standard':174C 'numer':50C 'opaqu':190C 'packag':76C 'package.json':57C 'payload':108C,158C 'per':21C 'pkg':150C 'pkg-config':149C 'printabl':140C 'product':114C 'read':46C 'relat':144C 'requir':73C,179C 'require-tim':178C 'result':65C 'run':110C 'sandbox':100C 'scan':120C 'set':102C 'ship':40C,193C 'short':87C 'short-circuit':86C 'smuggl':168C 'sourc':22C,30C 'stage':156C,204C 'standard':176C 'stay':117C 'string':141C 'time':180C 'travi':97C 'undeclar':48C 'util':38C,209C 'via':67C 'wdoj':37C 'wrap':80C 'zlib':59C 'zlib-infl':58C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T21:01:46+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-19142","url":"https://osv.dev/vulnerability/MAL-2026-19142","severity":"critical","published_at":"2026-11-11T21:01:46+00:00","modified_at":"2026-11-11T21:15:15+00:00","first_seen_at":"2026-11-11T21:29:24+00:00","fetched_at":"2026-11-11T21:29:24+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}