Malicious code in evil-pkg (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (9fafd2d99f9cf4494726ad31b7444c029e6af96702066992ae4b0741c5239b1a) Package declares `"bin": {"node": "./shim.js"}` in package.json, which registers `shim.js` as the `node` command in `node_modules/.bin`. In any environment where `node_modules/.bin` is prepended to PATH (notably Bun, but also any shell or tool that resolves binaries through the local bin directory), subsequent invocations of `node` — including those made by other packages' lifecycle scripts during the same install — will execute `shim.js` instead of the real Node.js runtime. When triggered, `shim.js` writes `/tmp/.bun-npm-pwned` and prints a hijack banner to stderr. The current payload is a benign marker, but the mechanism is a fully functional unconsented code-execution channel on the installer's machine: any code placed in `shim.js` would run with the installer's privileges whenever a sibling package invokes `node` during install. The package's own README markets this behavior as a PATH-poisoning attack proof-of-concept (`BunnyHijack`) and explicitly notes that a real attacker would use the same vector to exfiltrate `.env`, `~/.ssh`, and `~/.npmrc`. Hijacking a core runtime command name is not a legitimate use of the `bin` field and constitutes a deliberate supply-chain attack mechanism shipped to the registry.
AI Analysis
Technical Summary
The 'evil-pkg' npm package declares a 'bin' entry that maps the 'node' command to a local 'shim.js' script. When 'node_modules/.bin' is prepended to the PATH, any invocation of 'node' during package installation runs this shim instead of the legitimate Node.js runtime. The shim writes a marker file and prints a hijack banner, demonstrating a fully functional code execution channel. This allows arbitrary code execution with the installer's privileges during installation lifecycle scripts of sibling packages. The package README openly promotes this as a proof-of-concept for PATH poisoning attacks, noting that a real attacker could exfiltrate sensitive files such as '.env', '~/.ssh', and '~/.npmrc'. This hijacking of a core runtime command is a deliberate supply-chain attack vector.
Potential Impact
This vulnerability enables unconsented code execution on the installer's machine with the privileges of the user running the npm install. The malicious shim hijacks the 'node' command, potentially allowing attackers to execute arbitrary code during package installation, including exfiltration of sensitive environment and credential files. Although the current payload is benign, the mechanism is fully capable of malicious exploitation, posing a significant supply-chain risk.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing the affected versions (=1.0.0, =1.0.1, =1.0.2, =1.0.3, =1.0.4, =1.0.5) of 'evil-pkg'. Review your dependency tree for this package and remove or replace it. Monitor for updates from the package author or npm registry for any official fixes or removals. Until then, do not trust packages that hijack core runtime commands via the 'bin' field.
Malicious code in evil-pkg (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (9fafd2d99f9cf4494726ad31b7444c029e6af96702066992ae4b0741c5239b1a) Package declares `"bin": {"node": "./shim.js"}` in package.json, which registers `shim.js` as the `node` command in `node_modules/.bin`. In any environment where `node_modules/.bin` is prepended to PATH (notably Bun, but also any shell or tool that resolves binaries through the local bin directory), subsequent invocations of `node` — including those made by other packages' lifecycle scripts during the same install — will execute `shim.js` instead of the real Node.js runtime. When triggered, `shim.js` writes `/tmp/.bun-npm-pwned` and prints a hijack banner to stderr. The current payload is a benign marker, but the mechanism is a fully functional unconsented code-execution channel on the installer's machine: any code placed in `shim.js` would run with the installer's privileges whenever a sibling package invokes `node` during install. The package's own README markets this behavior as a PATH-poisoning attack proof-of-concept (`BunnyHijack`) and explicitly notes that a real attacker would use the same vector to exfiltrate `.env`, `~/.ssh`, and `~/.npmrc`. Hijacking a core runtime command name is not a legitimate use of the `bin` field and constitutes a deliberate supply-chain attack mechanism shipped to the registry.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'evil-pkg' npm package declares a 'bin' entry that maps the 'node' command to a local 'shim.js' script. When 'node_modules/.bin' is prepended to the PATH, any invocation of 'node' during package installation runs this shim instead of the legitimate Node.js runtime. The shim writes a marker file and prints a hijack banner, demonstrating a fully functional code execution channel. This allows arbitrary code execution with the installer's privileges during installation lifecycle scripts of sibling packages. The package README openly promotes this as a proof-of-concept for PATH poisoning attacks, noting that a real attacker could exfiltrate sensitive files such as '.env', '~/.ssh', and '~/.npmrc'. This hijacking of a core runtime command is a deliberate supply-chain attack vector.
Potential Impact
This vulnerability enables unconsented code execution on the installer's machine with the privileges of the user running the npm install. The malicious shim hijacks the 'node' command, potentially allowing attackers to execute arbitrary code during package installation, including exfiltration of sensitive environment and credential files. Although the current payload is benign, the mechanism is fully capable of malicious exploitation, posing a significant supply-chain risk.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing the affected versions (=1.0.0, =1.0.1, =1.0.2, =1.0.3, =1.0.4, =1.0.5) of 'evil-pkg'. Review your dependency tree for this package and remove or replace it. Monitor for updates from the package author or npm registry for any official fixes or removals. Until then, do not trust packages that hijack core runtime commands via the 'bin' field.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-6374
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a520eb968715ace438f5683
Added to database: 07/11/2026, 09:36:57 UTC
Last enriched: 07/11/2026, 09:52:52 UTC
Last updated: 07/30/2026, 20:24:18 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.