Threats Tagged 'mal-2026-10680'

The npm package 'syncgrove' version 1.4.0 contains malicious code that executes attacker-controlled shell commands during installation. Its postinstall script fetches an AES-CBC encrypted payload from an unauthenticated, plain HTTP remote server, decrypts it using a hardcoded key suffix, and executes the resulting commands via child_process.exec. The package falsely advertises itself as a simple greeting module, masking its malicious behavior. The use of an unencrypted HTTP endpoint allows an attacker or man-in-the-middle to modify the payload, leading to arbitrary code execution on the installer's machine.