🛡️ MAL-2026-12403 — node-cache-multithread

Malicious code in node-cache-multithread (npm)

Source: amazon-inspector

index.js, the package's declared main entry, is a ~23KB obfuscator.io RC4/base64 string-array bundle whose top-level IIFE runs on require(). It requires fs, os, path, child_process, and an HTTP client; builds a hardcoded remote URL from four numeric octets and a port (concealed inside the 314-entry string array); fetches a payload; splits the response into IV and ciphertext on ':'; decrypts with a hardcoded key via crypto.createDecipheriv; writes the plaintext to a file under os.tmpdir(); and spawns/execs it through child_process with windowsHide:true. The package advertises itself in the README as @array-util/nodepull while publishing under the name node-cache-multithread, so a developer following the README will install/require a differently-named tarball whose only shipped file is the dropper. No cache/library functionality is present.