Malicious code in mcq-session (npm)
The mcq-session npm package versions 1.0.3 and 1.0.4 contain malicious code that executes a hidden payload. When imported, the package runs an asynchronous function that reads an external file outside the package directory, decrypts it using a hardcoded DES key, and executes the decrypted JavaScript code via a detached Node.js subprocess. This behavior bypasses static code inspection by encrypting the payload and disguising the loader with misleading identifiers. The payload file is attacker-controlled and resides alongside the host application, enabling remote code execution without user consent or verification.
AI Analysis
Technical Summary
The mcq-session npm package (versions 1.0.3 and 1.0.4) includes a malicious top-level asynchronous function that triggers on import. This function reads a file located outside the package root at '../../../../public/logo.ico', decrypts it using DES with a hardcoded password 'bf497c0b9cee' through multiple CryptoJS decoding methods, and pipes the decrypted JavaScript payload into a detached, unreferenced Node.js subprocess. The decrypted code is executed without any signature or integrity checks, and the loader is obfuscated behind benign-sounding identifiers such as 'readLogoIco' and 'ThetaSDK initialization'. The encryption key is shipped with the loader, indicating the encryption is solely to evade static detection. The external file path suggests the payload is dropped separately by the installer and is attacker-controlled, enabling execution of arbitrary code in the host environment.
Potential Impact
This malicious package enables arbitrary code execution on any system that imports mcq-session versions 1.0.3 or 1.0.4. Because the payload is decrypted and executed without verification and is attacker-controlled, it can lead to full compromise of the host application environment. The use of a detached subprocess means the malicious code runs independently, potentially evading detection and control mechanisms. There is no indication of active exploitation in the wild yet, but the presence of such a backdoor poses a critical security risk.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately cease using mcq-session versions 1.0.3 and 1.0.4. Remove these versions from all environments and replace them with trusted alternatives. Conduct a thorough audit of systems where these versions were installed to detect any signs of compromise. Monitor for any suspicious detached Node.js subprocesses or unexpected file reads from '../../../../public/logo.ico'. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates. Avoid installing packages from untrusted sources and verify package integrity before use.
Malicious code in mcq-session (npm)
Description
The mcq-session npm package versions 1.0.3 and 1.0.4 contain malicious code that executes a hidden payload. When imported, the package runs an asynchronous function that reads an external file outside the package directory, decrypts it using a hardcoded DES key, and executes the decrypted JavaScript code via a detached Node.js subprocess. This behavior bypasses static code inspection by encrypting the payload and disguising the loader with misleading identifiers. The payload file is attacker-controlled and resides alongside the host application, enabling remote code execution without user consent or verification.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The mcq-session npm package (versions 1.0.3 and 1.0.4) includes a malicious top-level asynchronous function that triggers on import. This function reads a file located outside the package root at '../../../../public/logo.ico', decrypts it using DES with a hardcoded password 'bf497c0b9cee' through multiple CryptoJS decoding methods, and pipes the decrypted JavaScript payload into a detached, unreferenced Node.js subprocess. The decrypted code is executed without any signature or integrity checks, and the loader is obfuscated behind benign-sounding identifiers such as 'readLogoIco' and 'ThetaSDK initialization'. The encryption key is shipped with the loader, indicating the encryption is solely to evade static detection. The external file path suggests the payload is dropped separately by the installer and is attacker-controlled, enabling execution of arbitrary code in the host environment.
Potential Impact
This malicious package enables arbitrary code execution on any system that imports mcq-session versions 1.0.3 or 1.0.4. Because the payload is decrypted and executed without verification and is attacker-controlled, it can lead to full compromise of the host application environment. The use of a detached subprocess means the malicious code runs independently, potentially evading detection and control mechanisms. There is no indication of active exploitation in the wild yet, but the presence of such a backdoor poses a critical security risk.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately cease using mcq-session versions 1.0.3 and 1.0.4. Remove these versions from all environments and replace them with trusted alternatives. Conduct a thorough audit of systems where these versions were installed to detect any signs of compromise. Monitor for any suspicious detached Node.js subprocesses or unexpected file reads from '../../../../public/logo.ico'. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates. Avoid installing packages from untrusted sources and verify package integrity before use.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-14347
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a885f2facd9273b493f833c
Added to database: 08/21/2026, 14:22:39 UTC
Last enriched: 08/21/2026, 14:42:37 UTC
Last updated: 08/21/2026, 22:24:34 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.