MAL-2026-10582
Malicious code in async-mutex-v2 (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (7df420be80a00abb5efead6e83b37885cc37a347641386c0633719197dcb3dc5) Package published as 'async-mutex-v2' advertises itself as a Promise-based mutex but ships no mutex implementation. The main entry (index.js) exports getPlugin(), which performs an HTTPS request to https://svganchordev.net/icons/108 and passes the response field data.credits into `new Function('require','module',...,'Promise', data.credits)`, executing attacker-supplied JavaScript with full Node capabilities (require, process, Buffer, etc.) on the caller's host. A separate setDefaultModule routine referencing font-awesome/cdnjs strings acts as a decoy consistent with the icon-themed exfil host. Declared dependencies (@primno/dpapi, better-sqlite3, node-machine-id) are not used by any shipped code and are the standard toolkit for Windows DPAPI decryption, Chromium 'Login Data'/'Cookies' SQLite extraction, and host fingerprinting — capabilities that only make sense when invoked by the remotely-fetched payload. The package name, description ('Promise-based mutex'), and keywords (react, helper, svg) do not match the shipped code or dependencies, indicating a lookalike/cover-story around async-mutex.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for async-mutex-v2 (npm). Pin to a known-safe version or switch to an alternative.