MAL 2026 17330

osv.dev • October 13, 2026

Source: amazon-inspector (e14218599b46d143fa8e150156864d14d58c327bd8a8816221ac4e8c5cc99350)

The package advertises itself as an image bundler, but index.js performs no image bundling. On require, a top-level IIFE reads an AES-256-CBC-encrypted file at cdn-img-fetch/.cache/banner.jpg inside the sibling dependency cdn-img-fetch , decrypts it with a hardcoded key derived from sha256('nif-runtime-2027') , writes the plaintext to cdn-img-fetch/.runtime/rt.jpg , deletes the source file, and registers an fs.watch on the source directory so the decrypt-and-stage step still fires if the encrypted blob is delivered later. The package also calls cif.ensureCached() on the cdn-img-fetch dependency in an error-recovery path, wiring the two packages together as a coordinated staged dropper: cdn-img-fetch supplies the encrypted bytes and imgbundle acts as the decoder that materializes attacker-controlled content onto the installer's filesystem at import time. The README description of image bundling does not correspond to any code path in the module, and hardcoded-AES-key decryption of an opaque blob from another package is not a legitimate implementation of that stated purpose.

Source: ghsa-malware (6175161f6fa075711e55b1f0db7d346357ce5593b1e3b48fc30cd85aaad81576)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Amazon Inspector - FINDER [email protected]

Amazon Inspector - FINDER

[email protected]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malware Threat from Image Processing Packages Two vulnerabilities, MAL-2026-17216 and MAL-2026-17330, were disclosed on 2026-10-13, affecting the npm package 'cdn-img-fetch'. Both vulnerabilities allow attackers to drop malicious executables on systems that install or require this package. The malware is hidden within a PNG file, decrypted using a hardcoded key, and written to a persistent location on the filesystem. Any system running these packages is considered fully compromised, with all secrets and keys at risk. The vulnerabilities are linked to a deceptive image processing claim, with no legitimate functionality matching the malicious behavior. Users are advised to remove the affected packages immediately. 73

Extracted Entities

MAL 2026 17330

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

Email Addresses (1)

SHA256 Hashes (1)