Malicious code in mham-js (npm)

The mham-js package (version 1.0.4) includes a backdoor in src/api/session-api.js that triggers on import. It reads a file located outside the package directory (../../../../public/logo.ico), decrypts it with CryptoJS.DES using a hardcoded password 'bf497c0b9cee', and executes the decrypted bytes as code in a detached Node.js subprocess. The malicious loader uses misleading function names to disguise its purpose. The payload is attacker-controlled, encrypted outside the package tarball, and executed without verification or documentation, enabling arbitrary code execution.

This vulnerability allows an attacker to execute arbitrary code on any system that imports the affected mham-js package version 1.0.4. Because the payload is external and encrypted, it can be changed dynamically by the attacker, leading to potentially severe compromise including remote code execution and system takeover.

No official patch or remediation is currently documented. Users should immediately stop using mham-js version 1.0.4 and remove it from their projects. Avoid importing this package until a trusted, verified version is released. Monitor for updates from the package maintainer or npm security advisories for remediation.