MAL-2026-10385

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (1eec0d2d56f1e9730af8b7f3a7b8897e86491d48663f7b09ae7c716f6b3c0092)

speed3@1.1.7 is not a functional Node package. package.json declares main: sw.js, but sw.js is a browser ServiceWorker (importScripts('./8cfc2/hgshm.js'), self.addEventListener('install'|'activate'|'fetch'|'message')) — require('speed3') throws immediately in Node, so there is no install-time or import-time code-execution path that touches the installer. The tarball bundles a static web-proxy frontend (bare-mux / Ultraviolet / Scramjet stack, confirmed by bare-mux: running v2.1.9 in d1g0y/xsv4z.js) plus an index.html popunder that opens https://abdct.com/ on user click/keydown/touchstart with a 15-minute cooldown — browser behavior for visitors of the deployed site, not npm consumers. The tarball also ships auto-publish.sh (BASE="speed"; TOTAL=5; PARALLEL=2;... pkg.name = '$NAME'; npm publish --silent), and the recursive nested directories tmp_speed2/ and tmp_speed2/tmp_speed1/ inside the published tarball are direct evidence the author ran the script to mass-publish speed1..speed5 typosquat names. The many heavily-obfuscated assets/*.js files are browser bundles loaded by the deployed index.html and are not reachable from any Node entry point. Routing to human review for namespace-abuse adjudication: the lure is non-functional and the bundled obfuscated assets cannot be fully audited, so a reviewer should confirm the typosquat campaign and request takedown across the speedN family.

Source: ghsa-malware (f315db6d8f6ea167c5fefd27a41fdf2f5b515f1f52023c8bd617afad1fa411e6)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee...