core-js-gnz

GHSA-5q2j-22rc-7634

Malicious code in core-js-gnz (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (dc57686b95f827f2c3b0501d97b6575e077247255bf5d4227ae9bc8bedd43937)
On install, package.json runs `node init.js` as a postinstall hook. init.js collects host identifiers (os.hostname(), os.userInfo().username, os.platform(), os.arch(), node version, OS release) and POSTs them to https://helper.businesse-vip1.workers.dev/report, then fetches an AES-256-GCM encrypted blob from the /e endpoint on the same host (with TLS verification disabled via rejectUnauthorized:false), decrypts it in-process, writes the decoded content to the user cache directory as exec_runtime.py, and spawns a detached python3 process to execute it (stdio:'ignore', windowsHide, detached:true). Execution is gated on developer-machine heuristics (presence of Desktop/Documents/Downloads in the home directory) and rate-limited via a hidden ~/.cache/core-js-buffer/.init_check marker, with cover-story identifiers ('Environment check', 'TelemetrySender', a BIP-174 seed label). The package name and README advertise an unrelated hex-buffer utility, which does not match the observed behavior.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/7a1f1382a84618fabc1c45e8b61e9c9cea6ea33f/osv/malicious/npm/core-js-gnz/MAL-2026-17474.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/7a1f1382a84618fabc1c45e8b61e9c9cea6ea33f/osv/malicious/npm/core-js-gnz/MAL-2026-17474.json
- https://www.npmjs.com/package/core-js-gnz/v/1.0.0
- https://github.com/advisories/GHSA-5q2j-22rc-7634

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.