MAL-2026-11523

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (5a3d9e70c3e6f7e6c10d38a9f9e1d29bfea7c026fe7c5329c5817267bf4b759d) This tarball, published under the popular `cache-manager` name, ships an obfuscated `preinstall` dropper that does not exist in the upstream project. `package.json` declares `"preinstall": "node setup.mjs"`, and `setup.mjs` is a single-line obfuscator.io-style bundle (string-array + RC4-style per-call decoder at `i['tXsWiG']`) that hides every URL, filename, and command literal. Decoding reveals the loader detects the host platform, downloads a matching Bun runtime archive from `github.com/oven-sh/bun/releases` (e.g. `bun-linux-x64-baseline`, `bun-windows-x64-baseline`), extracts it to a temp directory, marks it executable, and then invokes that freshly downloaded runtime via `execFileSync` against the sibling file `Math_Symbol.js`. `Math_Symbol.js` is a 727 KB `// @bun @bun-cjs`-tagged opaque bundle with hex-obfuscated identifiers and its own string-array decoder; it is not referenced by the package's advertised entry point (`dist/index.cjs`) and is only reachable through the preinstall dropper. The alternate-runtime aspect (executing under Bun rather than Node) ensures the terminal payload is not observable to Node-based scanning of the tarball. The upstream `cache-manager` package ships no preinstall, no `setup.mjs`, and no `Math_Symbol.js`, so this version is a supply-chain compromise or lookalike rather than a legitimate release. Installing this version causes attacker-controlled code to execute on the installer's machine at `npm install` time.