tldriver

GHSA-ghjj-wrgg-p63j

Malicious code in tldriver (npm)

Details

**Severity:** Critical

**Affected versions:** `= 0.0.1`

## Source: amazon-inspector (c16e29eeb8037e1166c10990a8e8f9424095dacc208961fd85775b1b14470995)
The npm package [email protected] contains byte-identical scripts/preinstall.js and scripts/postinstall.js that are heavily obfuscated using obfuscator.io-style string-array indirection (identifiers such as _0x5694, _0x5c7e) to hide their URLs, filenames, and shell commands. On install, the scripts perform an https.get to the anonymous third-party image host https://api.imghippo.com/files/hOG8244hc.png, write the returned bytes to the package directory as gldriver_pre_core.exe and gldriver_pre_asset.exe, and then execute them via a platform-branched shell call (mspaint on Windows, open on macOS, xdg-open on Linux) before deleting the files and writing a.pre_setup_complete marker. The package identity is inconsistent with its shipped code: package.json declares the name tldriver, README instructs `npm install googledriver`, and index.js exports a class documented as GoogleDriver wrapping Google APIs, while the lib/ directory contains plausible-looking Google OAuth/Drive/Calendar/Maps modules that are never required by index.js. The declared library surface functions as a cover story; the operative behavior is the lifecycle-time fetch and execution of opaque bytes from a mutable third-party host, which lets the operator of that host deliver arbitrary code to any installer at any time.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/bac0e4e252a3c5e712237c271dacc3ef1ff1cf55/osv/malicious/npm/tldriver/MAL-2026-16384.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/bac0e4e252a3c5e712237c271dacc3ef1ff1cf55/osv/malicious/npm/tldriver/MAL-2026-16384.json
- https://www.npmjs.com/package/tldriver/v/0.0.1
- https://github.com/advisories/GHSA-ghjj-wrgg-p63j

Compromised versions (1)

= 0.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.