Malicious code in mutex-core (npm)

The mutex-core npm package (version 2.1.2) masquerades as a legitimate async-mutex library but contains a malicious staged loader. The runExclusive method checks if a callback's meta.jobId matches a hardcoded SHA-256 hash. If matched, it decrypts an encrypted payload file (lib/withMutex.min.js) using AES-256-GCM with a key derived from jobId via scryptSync, writes the decrypted code to disk, and executes it detached from the main process. The decryption and execution code is obfuscated and unrelated to the legitimate mutex functionality, indicating deliberate malicious intent. The actual payload remains opaque without the trigger key, preventing inspection of the executed code.

This malicious package can execute arbitrary code on the host system when triggered by a specific jobId, potentially leading to unauthorized code execution and compromise. Because the payload is encrypted and only decrypted at runtime, its full impact is unknown but could include any malicious activity. The presence of such a backdoor in a dependency poses a significant supply chain risk to projects using this package.

No official patch or remediation is currently documented. Users should immediately remove and replace mutex-core version 2.1.2 from their dependencies. Avoid using this package until a trusted, clean version is available. Monitor for any unusual activity related to this package and audit your supply chain dependencies for similar malicious code. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.