MAL-2026-13342
Malicious code in encrypt-string-safe (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (bcd2af56be68409ebeb33466f9647810127f9f06b36f7b8d3aeaac2a4308da9e) index.js is heavily obfuscated with obfuscator.io (rotated base64 string array + decoder wrapper). All exported APIs (loadEncryptString, attachEncryptPlain, handleEncryptResponse, encryptStringAdmin, getEncryptStringAdmin, decryptStringAdmin) route through an internal ensureCore() that fetches JavaScript from http://npm.jsdelivree.com/encrypt-string-admin-core/core.js and executes the response body in-process via `new Function('CryptoJS',...)`. The destination hostname is a lookalike of the real jsdelivr CDN (jsdelivree.com vs. jsdelivr.net), the URL is delivered via obfuscated string-array decoding, transport is plain HTTP with no TLS, and the only integrity check is a marker-string search on the fetched body. Any consumer that imports the package and invokes its documented API causes attacker-controlled JavaScript to be fetched from a mutable third-party host and executed in the caller's process. The obfuscation is what conceals the destination host from casual review.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for encrypt-string-safe (npm). Pin to a known-safe version or switch to an alternative.