ecinc-cloud-moaxmpp

Details

**Severity:** Critical

**Affected versions:** `> 0`

Package exhibits multiple malicious behaviors: Office doc access/encryption, DB interaction, local storage clearing, arbitrary code execution, /dev/shm ref. The code includes a native bridge that allows it to execute arbitrary SQL queries on a mobile device’s database when used within a specific mobile application context. The `ecmoaxmpp.umd.js` file revealed a highly suspicious pattern. The code includes a function that checks if `window.mappType` is not equal to `'web'`. When this condition is met, it proceeds to call `window.$wv.databaseHandle`, a function that acts as a bridge to a native mobile application. The methods invoked through this bridge include 'execute', 'rawQuery', 'rawInsert', 'rawUpdate', and 'rawDelete', all of which indicate direct, raw access to a mobile device’s database.## Source: amazon-inspector (278b09ddb42295dff2bd8c843131f7f3c9d4d793bb42dd797adbc9c6c825a656)
The package was found to contain malicious code or consuming dependency that contains malicious code

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/4411a9758acee53788fcb55dd9e35e49e8ea53cd/osv/malicious/npm/ecinc-cloud-moaxmpp/MAL-2025-6214.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/4411a9758acee53788fcb55dd9e35e49e8ea53cd/osv/malicious/npm/ecinc-cloud-moaxmpp/MAL-2025-6214.json
- https://platform.safedep.io/community/malysis/01K01T6C4JN4Q19HD1PAB151RZ
- https://www.npmjs.com/package/ecinc-cloud-moaxmpp/v/9.7.1
- https://www.npmjs.com/package/ecinc-cloud-moaxmpp/v/9.7.2
- https://github.com/advisories/GHSA-65hf-ffjr-7wpg

Compromised versions (1)

• > 0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.