{"id":"MAL-2026-19146","kind":"package","aliases":["MAL-2026-19146"],"related":[],"title":"Malicious code in teahy-znrpz-util (npm)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5d18143cb6c6ab53a6b224630d1b50f00578f4308414da4f384281a679d7861d)\nindex.js reads a numeric byte array stored under a non-standard `_bz` key inside package.json, decompresses it with zlib.inflateSync, and executes the resulting string via the Function constructor with `require` and `__dirname` bound in — all on module load. Execution is gated by an early-return when any of CI, GITHUB_ACTIONS, GITLAB_CI, TRAVIS, CIRCLECI, or SANDBOX environment variables are set, so the hidden code only runs on real developer or production hosts. Smuggling executable logic as a zlib blob under a private manifest key, decoding it, and running it through Function() at require time is an obfuscated-loader pattern; the package's self-description as a 'utility' does not match any behavior visible in its source. The payload executes with full Node privileges on the installer's machine as soon as the module is required.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"teahy-znrpz-util","fixed":[],"affected":"= 1.0.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-11T21:03:21+00:00","first_seen_at":"2026-11-11T21:29:24+00:00","triaged_at":"2026-11-11T21:30:27+00:00","updated_at":"2026-11-11T21:31:13+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-19146':11A,14A '-2026':10A,13A '5d18143cb6c6ab53a6b224630d1b50f00578f4308414da4f384281a679d7861d':34C 'action':87C 'amazon':32C 'amazon-inspector':31C 'array':40C 'behavior':151C 'blob':116C 'bound':68C 'byte':39C 'bz':47C 'ci':85C,89C 'circleci':91C 'code':2A,101C 'constructor':63C 'decod':122C 'decompress':51C 'descript':143C 'detail':23C 'develop':106C 'dirnam':67C 'earli':80C 'early-return':79C 'edit':26C 'environ':94C 'execut':56C,74C,111C,158C 'full':160C 'function':62C,128C 'gate':76C 'github':86C 'gitlab':88C 'hidden':100C 'host':109C 'index.js':35C 'insid':49C 'inspector':33C 'instal':165C 'key':48C,121C 'line':29C 'load':73C 'loader':136C 'logic':112C 'machin':167C 'mal':9A,12A 'malici':1A,19B 'manifest':120C 'match':149C 'modul':72C,172C 'node':161C 'non':45C 'non-standard':44C 'npm':8A 'numer':38C 'obfusc':135C 'obfuscated-load':134C 'packag':20B,139C 'package.json':50C 'pattern':137C 'payload':157C 'per':21C 'privat':119C 'privileg':162C 'product':108C 'read':36C 'real':105C 'requir':65C,130C,174C 'result':58C 'return':81C 'run':103C,125C 'sandbox':93C 'self':142C 'self-descript':141C 'set':97C 'smuggl':110C 'soon':169C 'sourc':22C,30C,155C 'standard':46C 'store':41C 'string':59C 'teahi':5A 'teahy':16A 'teahy-znrpz-util':4A,15A 'time':131C 'travi':90C 'util':7A,18A,146C 'variabl':95C 'via':60C 'visibl':152C 'zlib':115C 'zlib.inflatesync':54C 'znrpz':6A,17A","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["teahyznrpzutil"],"ptokens":["teahy","util","znrpz"],"labels":["critical","malicious","npm","package"],"campaign_type":null,"search_a":"'-19146':11A,14A '-2026':10A,13A 'code':2A 'mal':9A,12A 'malici':1A 'npm':8A 'teahi':5A 'teahy':16A 'teahy-znrpz-util':4A,15A 'util':7A,18A 'znrpz':6A,17A","search_b":"'malici':19B 'packag':20B","search_c":"'5d18143cb6c6ab53a6b224630d1b50f00578f4308414da4f384281a679d7861d':34C 'action':87C 'amazon':32C 'amazon-inspector':31C 'array':40C 'behavior':151C 'blob':116C 'bound':68C 'byte':39C 'bz':47C 'ci':85C,89C 'circleci':91C 'code':101C 'constructor':63C 'decod':122C 'decompress':51C 'descript':143C 'detail':23C 'develop':106C 'dirnam':67C 'earli':80C 'early-return':79C 'edit':26C 'environ':94C 'execut':56C,74C,111C,158C 'full':160C 'function':62C,128C 'gate':76C 'github':86C 'gitlab':88C 'hidden':100C 'host':109C 'index.js':35C 'insid':49C 'inspector':33C 'instal':165C 'key':48C,121C 'line':29C 'load':73C 'loader':136C 'logic':112C 'machin':167C 'manifest':120C 'match':149C 'modul':72C,172C 'node':161C 'non':45C 'non-standard':44C 'numer':38C 'obfusc':135C 'obfuscated-load':134C 'packag':139C 'package.json':50C 'pattern':137C 'payload':157C 'per':21C 'privat':119C 'privileg':162C 'product':108C 'read':36C 'real':105C 'requir':65C,130C,174C 'result':58C 'return':81C 'run':103C,125C 'sandbox':93C 'self':142C 'self-descript':141C 'set':97C 'smuggl':110C 'soon':169C 'sourc':22C,30C,155C 'standard':46C 'store':41C 'string':59C 'time':131C 'travi':90C 'util':146C 'variabl':95C 'via':60C 'visibl':152C 'zlib':115C 'zlib.inflatesync':54C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T21:03:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-19146","url":"https://osv.dev/vulnerability/MAL-2026-19146","severity":"critical","published_at":"2026-11-11T21:03:21+00:00","modified_at":"2026-11-11T21:15:16+00:00","first_seen_at":"2026-11-11T21:29:24+00:00","fetched_at":"2026-11-11T21:29:24+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}