o0o9

GHSA-w56x-ghfq-qjf4

Malicious code in o0o9 (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.8.0`

## Source: amazon-inspector (a1d425848ef7172faf5f84ff9bd9017bf3ab1eb2343a5301ff0df1711d091118)
The package's main entry index.js imports child_process at the top of the file and invokes spawn("powershell",...) as a top-level side effect (line 27). Loading the module via require/import causes an unprompted PowerShell process to launch on the installer's machine, which is a Windows-focused code execution vector wholly unrelated to any legitimate library function. This is the shape of an install/import-time execution payload rather than an API a caller must opt into.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/59452c16d914d2996795caf7ad918918250a99fa/osv/malicious/npm/o0o9/MAL-2026-14277.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/59452c16d914d2996795caf7ad918918250a99fa/osv/malicious/npm/o0o9/MAL-2026-14277.json
- https://www.npmjs.com/package/o0o9/v/1.8.0
- https://www.npmjs.com/package/o0o9/v/2.0.1
- https://github.com/advisories/GHSA-w56x-ghfq-qjf4

Compromised versions (1)

= 1.8.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.