Malicious code in index-ulid (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (5acad250c58c9c27804a14b640d17438998fbaabd43b77c69008c7180014f361) index-ulid impersonates the legitimate `ulid`/`ulidx` ULID generator (reuses ulid's description and links its homepage to github.com/ulid/javascript) but its `postinstall` script (package.json line 36: `node dist/node/utils.js`) is a cross-platform dropper. utils.js detaches with `--bg`, copies the bundled `dist/node/payload.js` into a directory named `MicrosoftSystem64` under the user's data-local directory (utils.js:7 `var UNIT_STEM = "MicrosoftSystem64"`) to disguise it as a Microsoft system component, then installs persistence on every major OS: Windows `schtasks /create /sc ONLOGON` (with a Registry Run key fallback), macOS detached spawn, and Linux `systemd --user` service or `~/.config/autostart`. The dropped binary is then launched in the background as `node payload.js --agent` (utils.js:75-79 `spawn(process.execPath, [jsPath, "--agent"], { detached: true })`). The 949 KB `payload.js` bundles a WebSocket client/server (`ws`), pino, zod, and contains string references to `/api/validate`, `/api/hf`, `https://huggingface.co/api`, and `Telegram` — a long-running C2 agent that beacons to remote services from every installer host. Both the postinstall and the agent contain a sandbox-evasion CPU gate (utils.js:155 skips when `cpus.length <= 4`; payload.js cpu-guard sets `MIN_CPU_COUNT = 5` and exits otherwise) so the dropper only fires on real developer/server machines and stays silent in malware sandboxes and small CI runners. None of this behavior is justified by a ULID library; the package is a typosquat lure for a persistent backdoor. ## Source: ghsa-malware (2b76e83c1fff9149fa6fd29f8c1ae854a428055508c5b0329b52ba444d5cf464) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
AI Analysis
Technical Summary
The index-ulid package impersonates legitimate ULID generators but contains a malicious postinstall script that runs a cross-platform dropper. This dropper copies a payload to a disguised directory and installs persistence mechanisms using Windows scheduled tasks or registry keys, macOS detached processes, and Linux systemd user services or autostart entries. The payload runs a WebSocket-based C2 agent that communicates with remote services including Hugging Face and Telegram APIs. Both the dropper and payload implement CPU count checks to evade sandbox and CI environments. The package is a typosquat lure designed to establish a persistent backdoor on developer and server machines.
Potential Impact
Systems that install or run this package are fully compromised, with a persistent backdoor installed that communicates with remote command-and-control servers. This allows attackers to maintain long-term access and potentially exfiltrate data or execute arbitrary commands. All secrets and keys stored on affected systems are at risk and should be rotated immediately. Removing the package alone may not eliminate the compromise due to persistence mechanisms.
Mitigation Recommendations
No official patch or fix is available. The package should be removed immediately from all affected systems. Because the malware installs persistent backdoors and may have full control over the system, all secrets and credentials stored on the compromised machine must be rotated from a separate, trusted device. Incident response should assume full system compromise and investigate for additional persistence or malware. Monitor for use of the package and avoid typosquatting variants.
Malicious code in index-ulid (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (5acad250c58c9c27804a14b640d17438998fbaabd43b77c69008c7180014f361) index-ulid impersonates the legitimate `ulid`/`ulidx` ULID generator (reuses ulid's description and links its homepage to github.com/ulid/javascript) but its `postinstall` script (package.json line 36: `node dist/node/utils.js`) is a cross-platform dropper. utils.js detaches with `--bg`, copies the bundled `dist/node/payload.js` into a directory named `MicrosoftSystem64` under the user's data-local directory (utils.js:7 `var UNIT_STEM = "MicrosoftSystem64"`) to disguise it as a Microsoft system component, then installs persistence on every major OS: Windows `schtasks /create /sc ONLOGON` (with a Registry Run key fallback), macOS detached spawn, and Linux `systemd --user` service or `~/.config/autostart`. The dropped binary is then launched in the background as `node payload.js --agent` (utils.js:75-79 `spawn(process.execPath, [jsPath, "--agent"], { detached: true })`). The 949 KB `payload.js` bundles a WebSocket client/server (`ws`), pino, zod, and contains string references to `/api/validate`, `/api/hf`, `https://huggingface.co/api`, and `Telegram` — a long-running C2 agent that beacons to remote services from every installer host. Both the postinstall and the agent contain a sandbox-evasion CPU gate (utils.js:155 skips when `cpus.length <= 4`; payload.js cpu-guard sets `MIN_CPU_COUNT = 5` and exits otherwise) so the dropper only fires on real developer/server machines and stays silent in malware sandboxes and small CI runners. None of this behavior is justified by a ULID library; the package is a typosquat lure for a persistent backdoor. ## Source: ghsa-malware (2b76e83c1fff9149fa6fd29f8c1ae854a428055508c5b0329b52ba444d5cf464) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The index-ulid package impersonates legitimate ULID generators but contains a malicious postinstall script that runs a cross-platform dropper. This dropper copies a payload to a disguised directory and installs persistence mechanisms using Windows scheduled tasks or registry keys, macOS detached processes, and Linux systemd user services or autostart entries. The payload runs a WebSocket-based C2 agent that communicates with remote services including Hugging Face and Telegram APIs. Both the dropper and payload implement CPU count checks to evade sandbox and CI environments. The package is a typosquat lure designed to establish a persistent backdoor on developer and server machines.
Potential Impact
Systems that install or run this package are fully compromised, with a persistent backdoor installed that communicates with remote command-and-control servers. This allows attackers to maintain long-term access and potentially exfiltrate data or execute arbitrary commands. All secrets and keys stored on affected systems are at risk and should be rotated immediately. Removing the package alone may not eliminate the compromise due to persistence mechanisms.
Mitigation Recommendations
No official patch or fix is available. The package should be removed immediately from all affected systems. Because the malware installs persistent backdoors and may have full control over the system, all secrets and credentials stored on the compromised machine must be rotated from a separate, trusted device. Incident response should assume full system compromise and investigate for additional persistence or malware. Monitor for use of the package and avoid typosquatting variants.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-5827
- Osv Schema Version
- 1.7.4
- Aliases
- ["GHSA-95pm-8vrw-2wrp"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a50ba4c68715ace4357ea7e
Added to database: 07/10/2026, 09:24:28 UTC
Last enriched: 07/10/2026, 09:40:11 UTC
Last updated: 07/29/2026, 08:57:44 UTC
Views: 14
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.