Threats tagged 'mal-2026-19142'

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (07a00a17209ccc173a7196dd8e97486609819945db1459a5333463be9f6c20b9) fcefi-wdojs-util@1.0.0 ships a loader in index.js that reads an undeclared `_bz` numeric array (~1000 bytes) from its own package.json, zlib-inflates it, and executes the resulting JavaScript via the Function constructor on every require of the package. The loader is wrapped in an IIFE that explicitly short-circuits when any of `CI`, `GITHUB_ACTIONS`, `GITLAB_CI`, `TRAVIS`, `CIRCLECI`, or `SANDBOX` are set in the environment, so the payload only runs on developer and production hosts and stays inert in scanning environments. Adjacent to the loader, lib/native.pkg_config is a 2,890,302-byte file containing only hex characters with no printable strings and no relation to native code or pkg-config, consistent with an encrypted stage-2 payload decrypted by the inflated bytecode. The combination — executable code smuggled inside the manifest as a non-standard field, require-time Function()-based execution, deliberate CI/sandbox evasion, and a large opaque hex blob shipped as a misleadingly named config file — is a multi-stage dropper with no legitimate utility function.