json-validator-utils

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (255dbc17164a6243a92bab0b4d71132efad3028b53e73d7d2924a1d7ccd1e8cf)
The package advertises itself as a JSON/XML validator but lib/core.js contains a multi-stage dropper triggered on any call to the public API (validateJson/validateXml). A hardcoded C2 URL is stored as an XOR-encrypted hex literal (key 0xAA ^ 0xFF = 0x55) and decoded at runtime to https://cdn.jsdelivr.net/gh/cryptonomad411/cool-utils/package.json — a personal GitHub account unrelated to the package's stated purpose. The decoded manifest supplies a platform+arch-keyed payload URL that is downloaded to /tmp or %TEMP% and executed (cscript on Windows; chmod+x and spawn('sh',...) on Linux/macOS). Execution is gated behind os.uptime() >= 300 to evade short-lived analysis sandboxes and CI containers. After running the second-stage payload, the Linux branch writes a randomly-named unit to ~/.config/systemd/user and enables it via `systemctl --user enable --now`, and the macOS branch writes a randomly-named plist to ~/Library/LaunchAgents and loads it via `launchctl load -w`, granting persistent auto-start execution of attacker-controlled code on the installer's host.

Compromised versions (4)

• 1.1.0
• 1.0.1
• 1.0.0
• 1.1.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.