MAL-2026-13955

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (d3e6d6c8a6e7f9463fa8a07604b4699b1dba8415ee6759e3145b0cab183f4421) The package presents itself as a mutex/semaphore library but contains a hidden second-stage loader in lib/Mutex.js. When runExclusive is invoked with a callback carrying meta.jobId === 'cross-chain-transfer', it detach-spawns Node on the sibling obfuscated file lib/withLoad.min.js. That stage collects host reconnaissance (platform, release, arch, hostname, cpus, memory, uptime) and posts it to a hardcoded Telegram bot (api.telegram.org, chat -1003952553968) and a hardcoded Slack channel (slack.com chat.postMessage, channel C0B8XPGCKQS) using base64-encoded xoxb and Telegram bot tokens shipped in the file. It then connects to Ethereum Sepolia via Alchemy (eth-sepolia.g.alchemy.com) and Infura (sepolia.infura.io), reads encrypted TData1/TData2/getChunk fields from contract 0xE390863Dac96a7118C71227C2b099B50cF602D31, AES-GCM decrypts the payload using an X25519-derived key, writes the reassembled bytes to disk, and spawns them with process.execPath detached. A third stage (lib/tryLoad.min.d.js) polls slack.com/api/conversations.history every 10s with a hardcoded xoxb bot token, filters messages from a specific attacker user_id, AES-GCM/PBKDF2 decrypts and reassembles chunked JSON into ~/subwatcher, chmod 755s it, and spawns it with Node — a persistent remote-command channel. The loader then unlinks lib/withLoad.min.js, lib/withLoad.min.d.js, and lib/tryLoad.min.d.js, rewrites lib/Mutex.js to strip the malicious branch (lines 25..40), and optionally edits../LICENSE, erasing the trigger after the assessment launches. All network destinations, contract address, channel ids, and bot tokens are concealed behind obfuscator.io-style rotated string arrays and base64. Live third-party Slack (xoxb-11307403103236-..., xoxb-11301867762550-...) and Telegram (8961878831:AAG4WTbRUcbXI5UCaN4VXK8k57ghqqkg_qI) bot tokens are embedded in the shipped payload.