{"id":"MAL-2026-19144","kind":"package","aliases":["MAL-2026-19144"],"related":[],"title":"Malicious code in strutil-helpers-core (npm)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (db7da8999828536292e11d09747504d964bf7525862de7d207d03c8809c438a0)\nThe package advertises itself as lightweight string utility helpers (trim/capitalize/truncate), but ships a 17KB Linux ELF.node addon, a 434KB Windows PE.node addon, and a 3.7MB opaque.napi_cache data blob none of which are needed for the stated purpose. index.js unconditionally loads the platform-appropriate native addon on every require() and swallows errors silently before the trivial string helpers are even defined. The native addon references the adjacent.napi_cache blob and contains code paths for file I/O, fork/setsid/execlp on Linux and CreateProcessA with a 'node \"%s\"' command template on Windows, staging decoded JavaScript at /tmp/.<pid> (format string /tmp/.%u, %s.nc%lu.js) and executing it under node. Before firing, the addon enumerates CI and sandbox indicators (GITHUB_ACTIONS, GITLAB_CI, TRAVIS, CIRCLECI, JENKINS_URL, BUILDKITE, CODEBUILD_BUILD_ID, APPVEYOR, SEMAPHORE, TEAMCITY_VERSION, BITBUCKET_BUILD_NUMBER, NETLIFY, VERCEL, CF_BUILD_ID, SCREWDRIVER, SANDBOX), reads /proc/1/cgroup, /proc/1/cmdline, /proc/self/status (TracerPid) and /proc/self/maps for docker/containerd/kubepod/podman markers, and on Windows checks IsDebuggerPresent, CheckRemoteDebuggerPresent and scans running processes for analysis tools (wireshark, httpdebug, Process32First). The combination of a trivial cover-story API, undeclared native binaries loaded silently on import, an opaque sibling blob decrypted to a hidden /tmp staging path and executed under node, and sandbox/CI/debugger evasion gating is a load-time dropper that runs attacker-controlled code on the installer's host as soon as the package is required.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"strutil-helpers-core","fixed":[],"affected":"= 1.0.1; = 1.0.2; = 1.0.4; = 1.0.5; = 1.0.3","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-11T20:54:40+00:00","first_seen_at":"2026-11-11T21:29:24+00:00","triaged_at":"2026-11-11T21:30:27+00:00","updated_at":"2026-11-11T21:31:13+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-19144':11A,14A '-2026':10A,13A '/proc/1/cgroup':178C '/proc/1/cmdline':179C '/proc/self/maps':183C '/proc/self/status':180C '/tmp':130C,133C,227C '17kb':48C '3.7':59C '434kb':53C 'action':152C 'addon':51C,56C,82C,100C,145C 'adjacent.napi':103C 'advertis':37C 'amazon':32C 'amazon-inspector':31C 'analysi':198C 'api':211C 'appropri':80C 'appveyor':163C 'attack':247C 'attacker-control':246C 'binari':214C 'bitbucket':167C 'blob':64C,105C,222C 'build':161C,168C,173C 'buildkit':159C 'cach':62C,104C 'cf':172C 'check':190C 'checkremotedebuggerpres':192C 'ci':147C,154C 'circleci':156C 'code':2A,108C,249C 'codebuild':160C 'combin':204C 'command':122C 'contain':107C 'control':248C 'core':7A,18A 'cover':209C 'cover-stori':208C 'createprocessa':117C 'data':63C 'db7da8999828536292e11d09747504d964bf7525862de7d207d03c8809c438a0':34C 'decod':127C 'decrypt':223C 'defin':97C 'detail':23C 'docker/containerd/kubepod/podman':185C 'dropper':243C 'edit':26C 'elf.node':50C 'enumer':146C 'error':88C 'evas':236C 'even':96C 'everi':84C 'execut':138C,231C 'file':111C 'fire':143C 'fork/setsid/execlp':113C 'format':131C 'gate':237C 'github':151C 'gitlab':153C 'helper':6A,43C,94C 'helpers':17A 'hidden':226C 'host':254C 'httpdebug':201C 'i/o':112C 'id':162C,174C 'import':218C 'index.js':74C 'indic':150C 'inspector':33C 'instal':252C 'isdebuggerpres':191C 'javascript':128C 'jenkin':157C 'lightweight':40C 'line':29C 'linux':49C,115C 'load':76C,215C,241C 'load-tim':240C 'lu.js':136C 'mal':9A,12A 'malici':1A,19B 'marker':186C 'mb':60C 'nativ':81C,99C,213C 'need':69C 'netlifi':170C 'node':120C,141C,233C 'none':65C 'npm':8A 'number':169C 'opaqu':220C 'opaque.napi':61C 'packag':20B,36C,259C 'path':109C,229C 'pe.node':55C 'per':21C 'platform':79C 'platform-appropri':78C 'process':196C 'process32first':202C 'purpos':73C 'read':177C 'refer':101C 'requir':85C,261C 'run':195C,245C 's.nc':135C 'sandbox':149C,176C 'sandbox/ci/debugger':235C 'scan':194C 'screwdriv':175C 'semaphor':164C 'ship':46C 'sibl':221C 'silent':89C,216C 'soon':256C 'sourc':22C,30C 'stage':126C,228C 'state':72C 'stori':210C 'string':41C,93C,132C 'strutil':5A,16A 'strutil-helpers-cor':4A 'strutil-helpers-core':15A 'swallow':87C 'teamciti':165C 'templat':123C 'time':242C 'tool':199C 'tracerpid':181C 'travi':155C 'trim/capitalize/truncate':44C 'trivial':92C,207C 'u':134C 'uncondit':75C 'undeclar':212C 'url':158C 'util':42C 'vercel':171C 'version':166C 'window':54C,125C,189C 'wireshark':200C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["strutilhelperscore"],"ptokens":["core","helpers","strutil"],"labels":["critical","malicious","npm","package"],"campaign_type":null,"search_a":"'-19144':11A,14A '-2026':10A,13A 'code':2A 'core':7A,18A 'helper':6A 'helpers':17A 'mal':9A,12A 'malici':1A 'npm':8A 'strutil':5A,16A 'strutil-helpers-cor':4A 'strutil-helpers-core':15A","search_b":"'malici':19B 'packag':20B","search_c":"'/proc/1/cgroup':178C '/proc/1/cmdline':179C '/proc/self/maps':183C '/proc/self/status':180C '/tmp':130C,133C,227C '17kb':48C '3.7':59C '434kb':53C 'action':152C 'addon':51C,56C,82C,100C,145C 'adjacent.napi':103C 'advertis':37C 'amazon':32C 'amazon-inspector':31C 'analysi':198C 'api':211C 'appropri':80C 'appveyor':163C 'attack':247C 'attacker-control':246C 'binari':214C 'bitbucket':167C 'blob':64C,105C,222C 'build':161C,168C,173C 'buildkit':159C 'cach':62C,104C 'cf':172C 'check':190C 'checkremotedebuggerpres':192C 'ci':147C,154C 'circleci':156C 'code':108C,249C 'codebuild':160C 'combin':204C 'command':122C 'contain':107C 'control':248C 'cover':209C 'cover-stori':208C 'createprocessa':117C 'data':63C 'db7da8999828536292e11d09747504d964bf7525862de7d207d03c8809c438a0':34C 'decod':127C 'decrypt':223C 'defin':97C 'detail':23C 'docker/containerd/kubepod/podman':185C 'dropper':243C 'edit':26C 'elf.node':50C 'enumer':146C 'error':88C 'evas':236C 'even':96C 'everi':84C 'execut':138C,231C 'file':111C 'fire':143C 'fork/setsid/execlp':113C 'format':131C 'gate':237C 'github':151C 'gitlab':153C 'helper':43C,94C 'hidden':226C 'host':254C 'httpdebug':201C 'i/o':112C 'id':162C,174C 'import':218C 'index.js':74C 'indic':150C 'inspector':33C 'instal':252C 'isdebuggerpres':191C 'javascript':128C 'jenkin':157C 'lightweight':40C 'line':29C 'linux':49C,115C 'load':76C,215C,241C 'load-tim':240C 'lu.js':136C 'marker':186C 'mb':60C 'nativ':81C,99C,213C 'need':69C 'netlifi':170C 'node':120C,141C,233C 'none':65C 'number':169C 'opaqu':220C 'opaque.napi':61C 'packag':36C,259C 'path':109C,229C 'pe.node':55C 'per':21C 'platform':79C 'platform-appropri':78C 'process':196C 'process32first':202C 'purpos':73C 'read':177C 'refer':101C 'requir':85C,261C 'run':195C,245C 's.nc':135C 'sandbox':149C,176C 'sandbox/ci/debugger':235C 'scan':194C 'screwdriv':175C 'semaphor':164C 'ship':46C 'sibl':221C 'silent':89C,216C 'soon':256C 'sourc':22C,30C 'stage':126C,228C 'state':72C 'stori':210C 'string':41C,93C,132C 'swallow':87C 'teamciti':165C 'templat':123C 'time':242C 'tool':199C 'tracerpid':181C 'travi':155C 'trim/capitalize/truncate':44C 'trivial':92C,207C 'u':134C 'uncondit':75C 'undeclar':212C 'url':158C 'util':42C 'vercel':171C 'version':166C 'window':54C,125C,189C 'wireshark':200C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T20:54:40+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-19144","url":"https://osv.dev/vulnerability/MAL-2026-19144","severity":"critical","published_at":"2026-11-11T20:54:40+00:00","modified_at":"2026-11-11T21:15:14+00:00","first_seen_at":"2026-11-11T21:29:24+00:00","fetched_at":"2026-11-11T21:29:24+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}