Malicious code in mutex-plus (npm)

The mutex-plus package version 3.0.2 includes a hidden branch in the runExclusive() method that triggers when a callback object contains a meta.jobId whose SHA-256 hash matches a hardcoded value. This branch decrypts an encrypted payload (lib/plusMutex.min.js) using AES-256-GCM with the jobId as the key, then executes the decrypted code as a detached Node.js process. The encrypted payload and its decryptor are obfuscated and disguised as TypeScript declaration files, which is unusual for a mutex primitive. This design allows an attacker who knows the correct jobId to achieve remote code execution on any system running this package version and invoking runExclusive with the crafted callback.

An attacker with knowledge of the specific jobId can remotely execute arbitrary code on any system using mutex-plus version 3.0.2 by supplying a crafted callback to the runExclusive() function. This can lead to full compromise of the affected environment where this package is used.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using mutex-plus version 3.0.2 or audit and remove this package from your environment if present. Do not pass untrusted callback objects to the runExclusive() method.