Threats Tagged 'mal-2026-10176'

The uncaxss npm package versions 1.3.4 and 1.3.5 contain malicious code that executes during installation. The package runs an obfuscated script in its postinstall lifecycle hook which fetches remote code from an attacker-controlled server, decodes it, and executes it with full Node.js privileges. This behavior enables remote code execution on the machine installing the package. The malicious payload is conditionally activated based on an environment variable, allowing selective targeting. The package lacks legitimate documentation and the remote code source is opaque and mutable, indicating a deliberate backdoor.