js-soul @1.0.4

Summary

On module load, src/api/session-api.js reads../../../../public/logo.ico (a path outside the package), DES-decrypts the contents with the hardcoded key 'bf497c0b9cee', spawns a detached node child process via child_process.spawn with {detached:true}, and pipes the decrypted plaintext into the interpreter's stdin, executing arbitrary code at import 'js-soul' . The disguise of executable JavaScript as an image asset, the hardcoded DES key, and an unrelated 'ThetaSDK initialization error' catch-block string contradict the package's stated purpose as a session helper library and its README claim that nothing runs on import. Any code the attacker stages at the sibling path executes in the installer process with the installer's privileges.

Source: amazon-inspector (3e5bb2e2d2011a8e8bcc3c0fba8aeed7cca1e1b92e19ea867535a27dbf2cc500)