imgbundle

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (e14218599b46d143fa8e150156864d14d58c327bd8a8816221ac4e8c5cc99350)
The package advertises itself as an image bundler, but index.js performs no image bundling. On require, a top-level IIFE reads an AES-256-CBC-encrypted file at `cdn-img-fetch/.cache/banner.jpg` inside the sibling dependency `cdn-img-fetch`, decrypts it with a hardcoded key derived from `sha256('nif-runtime-2027')`, writes the plaintext to `cdn-img-fetch/.runtime/rt.jpg`, deletes the source file, and registers an `fs.watch` on the source directory so the decrypt-and-stage step still fires if the encrypted blob is delivered later. The package also calls `cif.ensureCached()` on the `cdn-img-fetch` dependency in an error-recovery path, wiring the two packages together as a coordinated staged dropper: `cdn-img-fetch` supplies the encrypted bytes and `imgbundle` acts as the decoder that materializes attacker-controlled content onto the installer's filesystem at import time. The README description of image bundling does not correspond to any code path in the module, and hardcoded-AES-key decryption of an opaque blob from another package is not a legitimate implementation of that stated purpose.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/770428f773c57daa2de3ac23ad3257d748d27072/osv/malicious/npm/imgbundle/MAL-2026-17330.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/770428f773c57daa2de3ac23ad3257d748d27072/osv/malicious/npm/imgbundle/MAL-2026-17330.json
- https://www.npmjs.com/package/imgbundle/v/1.0.0
- https://www.npmjs.com/package/imgbundle/v/1.0.1
- https://github.com/advisories/GHSA-5p43-g79v-96pj

Compromised versions (1)

• = 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.