linux-ci-utils @1.0.0
Vulnerability report · Last retrieved from osv.dev June 24, 2026 at 12:37 PM UTC
OSV ID
MAL-2026-6377
Ecosystem
npm
Summary
On require(), index.js performs a Linux platform check, then decodes a base64-obfuscated URL (https://api.ingress-hub.com/cdn/assets/update.pkg) and HTTPS-downloads an opaque binary into a hidden staging path (~/.local/share/.node_cache/.runtime), chmods 0755, drops a.lock sentinel, and spawns the binary detached with stdio ignored. There is no hash or signature verification, the URL is mutable and not version-pinned, and the host (api.ingress-hub.com) is unrelated to the package's stated purpose ('CI utilities'). Identifiers are single-letter underscore-prefixed (_D,_N,_P,_F,_U,_A,_init,_run) and the destination URL is base64-hidden — obfuscation consistent with evading casual review and registry scanners rather than minification. The package's published name (linux-ci-utils) does not match its README (which advertises 'node-ci-utils'), consistent with masquerading as a plausible utility to entice installs. Any project that requires this package executes attacker-controlled bytes on Linux hosts at import time.
Source: amazon-inspector (8b2c5010ed5043c947b561f4359869ec7c0f6cdf219d0b2aa35c039e36812a01)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.