Malicious code in tldriver (npm)

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c16e29eeb8037e1166c10990a8e8f9424095dacc208961fd85775b1b14470995) The npm package [email protected] contains byte-identical scripts/preinstall.js and scripts/postinstall.js that are heavily obfuscated using obfuscator.io-style string-array indirection (identifiers such as _0x5694, _0x5c7e) to hide their URLs, filenames, and shell commands. On install, the scripts perform an https.get to the anonymous third-party image host https://api.imghippo.com/files/hOG8244hc.png, write the returned bytes to the package directory as gldriver_pre_core.exe and gldriver_pre_asset.exe, and then execute them via a platform-branched shell call (mspaint on Windows, open on macOS, xdg-open on Linux) before deleting the files and writing a.pre_setup_complete marker. The package identity is inconsistent with its shipped code: package.json declares the name tldriver, README instructs `npm install googledriver`, and index.js exports a class documented as GoogleDriver wrapping Google APIs, while the lib/ directory contains plausible-looking Google OAuth/Drive/Calendar/Maps modules that are never required by index.js. The declared library surface functions as a cover story; the operative behavior is the lifecycle-time fetch and execution of opaque bytes from a mutable third-party host, which lets the operator of that host deliver arbitrary code to any installer at any time.

Source published

22 Sep 2026 14:52:12 UTC

Source modified

22 Sep 2026 15:31:47 UTC

Saved here

24 Oct 2026 13:17:17 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.