{"id":"MAL-2026-17301","revision":"c6c871760c1848d7b1cd2db7b341e13d","records":[{"revision":"c6c871760c1848d7b1cd2db7b341e13d","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-17301","aliases":[],"title":"Malicious code in fs-commons (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f7e82e98343807c39ea786017de4d2a7455815424155ca2a856333d895c8a48b)\nThe package presents itself as a filesystem/data-helper library, but its exported getTransactions()/load_transaction_data() functions are a two-file dynamic-code loader. index.js hides the identifiers 'Function', 'require', 'process', 'Buffer', and 'setTimeout' behind a split-string array and obtains the Function constructor indirectly via globalThis.constructor.constructor, defeating static review. At call time it reads the sibling file models.js, which is disguised as an array of product-record objects but whose `mark` fields are base64 ciphertext. loadConfig()/processData() sort the records by id, concatenate every `mark`, apply a per-count Caesar shift, base64-decode the result, and pass the resulting source to the Function constructor with Buffer, require, and process injected, then invoke it. Any consumer that requires fs-commons and calls getTransactions() executes attacker-supplied code with full Node privileges on the host process. The obfuscation, the indirect Function-constructor acquisition, and the disguising of the payload as product metadata in a sibling file have no legitimate purpose for a data-helper library and are the fingerprint of a supply-chain remote-code-execution package.\n","state":0,"publishedAt":"2026-09-29T23:24:17+00:00","modifiedAt":"2026-09-29T23:45:38.4888837+00:00","affected":[{"ecosystem":"npm","name":"fs-commons","ranges":[],"versions":["1.0.1"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/fs-commons/v/1.0.1"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17301","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17301","identifiers":["MAL-2026-17301"]},"retained":false,"historicalAffected":[]}],"coverage":[]}