ecinc-cloud-moaxmpp (npm) · Malicious Code
Affects ecinc-cloud-moaxmppSource GCVE Database
Rated by Threat Radar
Data as of 9 Jul 2026, 10:06 UTC
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmecinc-cloud-moaxmpp | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Users and organizations should immediately discontinue use of ecinc-cloud-moaxmpp versions 9.7.1 and 9.7.2. Review and remove these versions from projects and dependency trees. Consider replacing the package with a trusted alternative. Monitor for any unusual database or application behavior on affected mobile devices.
Description
The npm package ecinc-cloud-moaxmpp versions 9.7.1 and 9.7.2 contains malicious code exhibiting multiple harmful behaviors including Office document access and encryption, database interaction, local storage clearing, and arbitrary code execution. It includes a native bridge enabling execution of arbitrary SQL queries on a mobile device's database within a specific mobile application context. This allows direct raw access to the device's database through functions such as execute, rawQuery, rawInsert, rawUpdate, and rawDelete. This malicious functionality is triggered when the environment is not a web context, indicating targeted misuse in mobile app environments.