Malicious code in mutex-lite (npm)

The mutex-lite npm package (version 1.4.2) masquerades as the async-mutex library but contains malicious modifications. The Mutex.prototype.runExclusive method covertly requires an obfuscated module that decrypts an AES-256-GCM encrypted payload using a key derived from callback.meta.jobId. When triggered by a hardcoded SHA1 gate, the payload is decrypted, written to a temporary file, and executed as a detached Node.js process with suppressed output. The encrypted payload includes the ethers library, indicating a focus on Ethereum wallet operations. This leads to arbitrary code execution under the context of the consuming application when the attacker-supplied jobId is used.

Applications that depend on mutex-lite version 1.4.2 and invoke the runExclusive method with the attacker-known jobId are vulnerable to arbitrary code execution. The malicious payload runs detached and silently, potentially compromising Ethereum wallet operations or other sensitive functionality within the host environment. This could lead to unauthorized actions, data theft, or further system compromise.

No official patch or remediation is currently documented for mutex-lite version 1.4.2. Users should immediately remove and replace this package with the legitimate async-mutex library or other trusted alternatives. Avoid using mutex-lite version 1.4.2 and audit dependencies to ensure no malicious packages are present. Monitor for suspicious processes spawned by Node.js and verify package integrity before use.