MAL-2026-13342
Malicious code in encrypt-string-safe (npm)
상세
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (bcd2af56be68409ebeb33466f9647810127f9f06b36f7b8d3aeaac2a4308da9e) index.js is heavily obfuscated with obfuscator.io (rotated base64 string array + decoder wrapper). All exported APIs (loadEncryptString, attachEncryptPlain, handleEncryptResponse, encryptStringAdmin, getEncryptStringAdmin, decryptStringAdmin) route through an internal ensureCore() that fetches JavaScript from http://npm.jsdelivree.com/encrypt-string-admin-core/core.js and executes the response body in-process via `new Function('CryptoJS',...)`. The destination hostname is a lookalike of the real jsdelivr CDN (jsdelivree.com vs. jsdelivr.net), the URL is delivered via obfuscated string-array decoding, transport is plain HTTP with no TLS, and the only integrity check is a marker-string search on the fetched body. Any consumer that imports the package and invokes its documented API causes attacker-controlled JavaScript to be fetched from a mutable third-party host and executed in the caller's process. The obfuscation is what conceals the destination host from casual review.
이 버전이 영향받나요?
사용 중인 패키지 버전을 입력하면 즉시 평가합니다.
영향 패키지
No fixed version published yet for encrypt-string-safe (npm). Pin to a known-safe version or switch to an alternative.