ecinc-cloud-moaxmpp

Details

Package exhibits multiple malicious behaviors: Office doc access/encryption, DB interaction, local storage clearing, arbitrary code execution, /dev/shm ref. The code includes a native bridge that allows it to execute arbitrary SQL queries on a mobile device’s database when used within a specific mobile application context. The `ecmoaxmpp.umd.js` file revealed a highly suspicious pattern. The code includes a function that checks if `window.mappType` is not equal to `'web'`. When this condition is met, it proceeds to call `window.$wv.databaseHandle`, a function that acts as a bridge to a native mobile application. The methods invoked through this bridge include 'execute', 'rawQuery', 'rawInsert', 'rawUpdate', and 'rawDelete', all of which indicate direct, raw access to a mobile device’s database.

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (278b09ddb42295dff2bd8c843131f7f3c9d4d793bb42dd797adbc9c6c825a656)
The package was found to contain malicious code or consuming dependency that contains malicious code

Compromised versions (2)

• 9.7.1
• 9.7.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.