runhelper

GHSA-pxgx-w72j-f3p8

Malicious code in runhelper (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (3b30a78c30f51a72d8501b77d0cf6190319b8876ed7a119cc2f885adc3618212)
On `require('runhelper')`, index.js unconditionally loads a payload file staged by its dependency `imgbundle` at `cdn-img-fetch/.runtime/rt.jpg`, allocates executable memory via kernel32 `VirtualAlloc` with `PAGE_EXECUTE_READWRITE` (0x40) and `MEM_COMMIT|MEM_RESERVE` (0x3000) through the `koffi` FFI, copies the file bytes with `RtlMoveMemory`, and executes them with `CreateThread`. The payload file is deleted after launch, and an `fs.watch` waits for it if not yet present. The `.jpg` extension in a hidden `.runtime` directory disguises an executable payload, and all errors are swallowed with empty `catch (_) {}` blocks. The advertised `exec()` spawn wrapper described in the README is a cover story: the module's top-level behavior on load is native shellcode execution. The manifest pins `imgbundle@^1.0.0` (payload source) and `koffi@^2.8.0` (FFI used to run it); the loader/payload split means anything that transitively requires runhelper on Windows fetches and executes attacker-supplied native code in-process.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/c1e4a243ed4c50cc2f092b964eb5912dc5c2ba9b/osv/malicious/npm/runhelper/MAL-2026-17332.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/c1e4a243ed4c50cc2f092b964eb5912dc5c2ba9b/osv/malicious/npm/runhelper/MAL-2026-17332.json
- https://www.npmjs.com/package/runhelper/v/1.0.0
- https://github.com/advisories/GHSA-pxgx-w72j-f3p8

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.