Malicious code in @worrisome/reutil (npm)

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security (see reference). The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute at `npm install` time. index.html renders a fake Cloudflare Turnstile verification widget. An obfuscator.io-obfuscated inline script POSTs a hardcoded per-package "hostKey" to https://api.keyval.org/get, receives a base64-encoded IV:ciphertext pair, decrypts it client-side via the Web Crypto API (AES-CTR) using an embedded key to obtain a redirect URL, appends the visitor's original query-string parameters, and navigates the browser there via window.location.replace(). This "dead drop" design lets the operator change the phishing destination for every package sharing a hostKey without republishing to npm; OX Security observed keyval.org-served destinations including a typosquatted Microsoft login page and, at time of writing, a ChatGPT redirect. The package therefore does not attack the installing machine directly; it is used as a static file host on the npm CDN (e.g. unpkg/jsDelivr) so the index.html can be linked to and opened directly in a victim's browser as a phishing/ClickFix landing page. Published by npm user "cattishly" as part of a burst of near-identical single-purpose packages published between 2026-08-04 and 2026-08-24 that share this same fake-Turnstile-redirect page structure. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (eb0b278fa833e7d9d9b054a90f8b5454b7e8bb0a10c9dd1c3a3a0e452ccefa43) The package's only shipped artifact is an index.html file that imitates a Cloudflare 'Just a moment...' challenge. The page fetches an AES-CTR-encrypted destination from https://api.keyval.org/get using a hardcoded key, decrypts it in the browser, and redirects via window.location.replace. There is no JavaScript module entry point, no require-able code, and no preinstall/install/postinstall/prepare lifecycle scripts in package.json. Installing or importing the package in a Node/npm context does not read installer secrets, fetch or execute remote code, or establish any network callback on the installer's machine. The abuse pattern is use of the npm registry as hosting for a browser-facing redirect/phishing landing page, which affects humans who open the HTML in a browser rather than developers who install the package as a dependency. ## Source: ghsa-malware (ad22aa3768124294f33e5d03ae20c30c446154a102cd46e6ede7c6b3d58c7280) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Source published

26 Aug 2026 14:55:09 UTC

Source modified

29 Oct 2026 14:30:32 UTC

Observed here

29 Oct 2026 15:12:22 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.