Malicious code in aegis-runtime (npm)
The npm package aegis-runtime version 1.0.0 contains malicious code in its postinstall hook. This hook executes a script that fetches and runs remote code from an untrusted external source with TLS validation disabled, allowing arbitrary code execution during installation. The package metadata misrepresents its purpose and author, indicating malicious intent.
AI Analysis
Technical Summary
The aegis-runtime npm package version 1.0.0 declares a postinstall hook that runs 'node src/test.js'. This script performs an HTTPS GET request to https://workconfig.vercel.app with TLS certificate validation disabled (rejectUnauthorized: false). The response body is then executed as JavaScript code via 'new Function', passing the installer's require function, enabling execution of arbitrary code fetched from a mutable, non-registry host unrelated to the package's stated functionality. The package metadata falsely advertises it as a Node.js runtime monitoring toolkit and uses a placeholder author name, further indicating malicious behavior.
Potential Impact
Installation of aegis-runtime version 1.0.0 results in execution of arbitrary code fetched from an untrusted external source with disabled TLS validation, potentially compromising the system where the package is installed. This can lead to unauthorized code execution, data compromise, or system control by attackers.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing aegis-runtime version 1.0.0. Verify package authenticity before installation and consider removing this package if already installed. Monitor for updates from the package publisher or npm advisories for any official fixes.
Malicious code in aegis-runtime (npm)
Description
The npm package aegis-runtime version 1.0.0 contains malicious code in its postinstall hook. This hook executes a script that fetches and runs remote code from an untrusted external source with TLS validation disabled, allowing arbitrary code execution during installation. The package metadata misrepresents its purpose and author, indicating malicious intent.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The aegis-runtime npm package version 1.0.0 declares a postinstall hook that runs 'node src/test.js'. This script performs an HTTPS GET request to https://workconfig.vercel.app with TLS certificate validation disabled (rejectUnauthorized: false). The response body is then executed as JavaScript code via 'new Function', passing the installer's require function, enabling execution of arbitrary code fetched from a mutable, non-registry host unrelated to the package's stated functionality. The package metadata falsely advertises it as a Node.js runtime monitoring toolkit and uses a placeholder author name, further indicating malicious behavior.
Potential Impact
Installation of aegis-runtime version 1.0.0 results in execution of arbitrary code fetched from an untrusted external source with disabled TLS validation, potentially compromising the system where the package is installed. This can lead to unauthorized code execution, data compromise, or system control by attackers.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing aegis-runtime version 1.0.0. Verify package authenticity before installation and consider removing this package if already installed. Monitor for updates from the package publisher or npm advisories for any official fixes.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-12335
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a735750bf8831d53915a609
Added to database: 08/05/2026, 15:31:28 UTC
Last enriched: 08/05/2026, 17:49:15 UTC
Last updated: 08/05/2026, 17:49:15 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.