Malicious code in mutex-lite (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (d9dd128447234dcf0a624ed4128fc5135f11c4c0c4cd2b12b7b81614f50015c5) The package is named to resemble async-mutex and exports a Mutex API with the same surface, but lib/Mutex.js has been altered so that Mutex.prototype.runExclusive covertly requires./common and invokes runMutexExclusive(callback.meta.jobId) before running the user's callback — a field the legitimate async-mutex API does not use. lib/common.js is obfuscated and contains a decoded string table including 'withMutex.min.js', 'aes-256-gcm', and 'scrypt' plus a hardcoded SHA1 gate 'b7e54f...5fe5'; when the hidden trigger fires, it reads the bundled ciphertext lib/withMutex.min.js, decrypts it with AES-256-GCM using material derived from callback.meta.jobId, writes the plaintext to os.tmpdir(), and runs it with require('child_process').spawn('node', [tempFile,...], {detached:true, stdio:'ignore', windowsHide:true}). The sibling file lib/withMutex.min.d.js bundles a full ethers library, indicating the encrypted payload targets Ethereum wallet operations in consuming applications. Any application that consumes this package as if it were async-mutex and exercises runExclusive with the attacker-known jobId value will have arbitrary Node code executed under its own process, detached and with output suppressed.
Malicious code in mutex-lite (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (d9dd128447234dcf0a624ed4128fc5135f11c4c0c4cd2b12b7b81614f50015c5) The package is named to resemble async-mutex and exports a Mutex API with the same surface, but lib/Mutex.js has been altered so that Mutex.prototype.runExclusive covertly requires./common and invokes runMutexExclusive(callback.meta.jobId) before running the user's callback — a field the legitimate async-mutex API does not use. lib/common.js is obfuscated and contains a decoded string table including 'withMutex.min.js', 'aes-256-gcm', and 'scrypt' plus a hardcoded SHA1 gate 'b7e54f...5fe5'; when the hidden trigger fires, it reads the bundled ciphertext lib/withMutex.min.js, decrypts it with AES-256-GCM using material derived from callback.meta.jobId, writes the plaintext to os.tmpdir(), and runs it with require('child_process').spawn('node', [tempFile,...], {detached:true, stdio:'ignore', windowsHide:true}). The sibling file lib/withMutex.min.d.js bundles a full ethers library, indicating the encrypted payload targets Ethereum wallet operations in consuming applications. Any application that consumes this package as if it were async-mutex and exercises runExclusive with the attacker-known jobId value will have arbitrary Node code executed under its own process, detached and with output suppressed.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-14281
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a85b4b4acd9273b49251557
Added to database: 08/19/2026, 13:50:44 UTC
Last updated: 08/19/2026, 13:51:31 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.