anhn-cli

Details

**Severity:** Critical

**Affected versions:** `= 1.1.4`

## Source: amazon-inspector (7b0f11f74231c27bd3e3ac41dea5290466f042224f64547d88a328d6b87cf657)
bin/install/install.js appends a heavily obfuscated top-level IIFE (obfuscator.io-style rotated string array `_0x240a`/`_0x4963` with arithmetic index decoding) after the benign install() helper. The payload queries public Ethereum RPCs and etherscan.io for transactions from the hardcoded sender address 0xa322E5f3..., decodes the transaction `to` field as an IPv4 address, fetches an XOR-encrypted body from that host, and executes it via `eval(prefix+xor(body))` and a detached `spawn('node', ['-e',...], {detached:true}).unref()`. The package's main entry (bin/index.js) unconditionally requires./install/install, so the IIFE runs whenever the package is required or the CLI is invoked. The attacker controls the fetched payload by publishing new Ethereum transactions from the sender address; there is no version pinning, no signature check, and the destination host rotates on-chain. Decoded strings inside the string array include `eth_getBlockByNumber`, `etherscan.io`, `eval`, and `spawn`.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/212ab477a3bdce7d9f5412f6647f735d6aecceb6/osv/malicious/npm/anhn-cli/MAL-2026-14290.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/212ab477a3bdce7d9f5412f6647f735d6aecceb6/osv/malicious/npm/anhn-cli/MAL-2026-14290.json
- https://www.npmjs.com/package/anhn-cli/v/1.1.4
- https://github.com/ossf/malicious-packages/blob/ca35a319f3c5255ac2d7f28cf58023d75de17a35/osv/malicious/npm/anhn-cli/MAL-2026-14290.json
- https://github.com/advisories/GHSA-fwrc-9gjh-wr72

Compromised versions (1)

• = 1.1.4

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.