MAL-2026-18329

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b0a88993bf967d1bbbc61cb5f43b4d9af5d9ef74b920e70d828b4a52bf880979)

The package advertises itself as 'Cache utilities' but ships no source, no binding.gyp, and no build configuration — only two prebuilt native addons (addon.node ELF for Linux, addon_win.node PE for Windows) and a 4,164,844-byte opaque, high-entropy file named.napi_cache with no readable strings and no magic header. The package.json postinstall hook runs node -e "try{require(process.platform==='win32'?'./addon_win.node':'./addon.node').init()}catch(e){}", loading the platform-specific native binary and invoking init() on every install, with the error swallowed to suppress install-time noise. The Linux addon contains the format string '%s/.napi_cache' alongside fopen64/fread, references a '/tmp/.%u' staging path, and uses fork, setsid, execlp, chmod and _exit primitives — the shape of a drop-and-detach loader that reads the bundled.napi_cache blob, writes it to a hidden /tmp path, chmods it executable and runs it as a detached process. The addon also encodes an extensive evasion suite: environment checks for GITHUB_ACTIONS, GITLAB_CI, TRAVIS, CIRCLECI, JENKINS_URL, BUILDKITE, CODEBUILD_BUILD_ID, APPVEYOR, SEMAPHORE, TEAMCITY_VERSION, BITBUCKET_BUILD_NUMBER, NETLIFY, VERCEL, CF_BUILD_ID and SANDBOX; container probes against /proc/1/cgroup, docker, containerd, kubepod and podman; a TracerPid: debugger check via /proc/self/status; and host fingerprinting through /proc/meminfo, /proc/cpuinfo and /proc/self/maps. The combination — hollow self-description, source-less native binaries, lifecycle-hook execution of a staged opaque payload, and CI/sandbox/debugger gating — has no overlap with any legitimate cache library and is the fingerprint of an install-time dropper for attacker-controlled code.