Malicious code in timed-assess (npm)
The timed-assess npm package versions 1.0.0 and 1.0.1 contain malicious code that executes attacker-controlled JavaScript during installation. The postinstall script decrypts a bundled payload using a hardcoded DES key and runs it in a detached Node.js process, suppressing output to avoid detection.
AI Analysis
Technical Summary
The timed-assess package's postinstall script runs 'node apps/index.js', which decrypts a bundled file with a hardcoded DES key ('bf497c0b9cee') via CryptoJS.DES.decrypt. The decrypted JavaScript is piped into a detached Node.js process with stdio ignored, allowing silent execution of arbitrary code on the host during 'npm install'. Misleading identifiers and log messages are used to obfuscate the malicious behavior. This results in automatic execution of attacker-controlled code on the installer's system.
Potential Impact
This vulnerability allows arbitrary JavaScript code execution on any system that installs the affected timed-assess package versions, potentially leading to system compromise, data theft, or further malware deployment. The execution is silent due to suppressed stdio, increasing the risk of unnoticed infection.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing timed-assess versions 1.0.0 and 1.0.1. Verify package integrity before installation and consider using trusted package sources or alternative packages. Monitor vendor advisories for updates or fixes.
Malicious code in timed-assess (npm)
Description
The timed-assess npm package versions 1.0.0 and 1.0.1 contain malicious code that executes attacker-controlled JavaScript during installation. The postinstall script decrypts a bundled payload using a hardcoded DES key and runs it in a detached Node.js process, suppressing output to avoid detection.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The timed-assess package's postinstall script runs 'node apps/index.js', which decrypts a bundled file with a hardcoded DES key ('bf497c0b9cee') via CryptoJS.DES.decrypt. The decrypted JavaScript is piped into a detached Node.js process with stdio ignored, allowing silent execution of arbitrary code on the host during 'npm install'. Misleading identifiers and log messages are used to obfuscate the malicious behavior. This results in automatic execution of attacker-controlled code on the installer's system.
Potential Impact
This vulnerability allows arbitrary JavaScript code execution on any system that installs the affected timed-assess package versions, potentially leading to system compromise, data theft, or further malware deployment. The execution is silent due to suppressed stdio, increasing the risk of unnoticed infection.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing timed-assess versions 1.0.0 and 1.0.1. Verify package integrity before installation and consider using trusted package sources or alternative packages. Monitor vendor advisories for updates or fixes.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-14216
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a85b4c7acd9273b49252839
Added to database: 08/19/2026, 13:51:03 UTC
Last enriched: 08/19/2026, 14:38:43 UTC
Last updated: 08/19/2026, 14:38:43 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.