🛡️ MAL-2026-12514 — async-mutex-v3

Malicious code in async-mutex-v3 (npm)

Source: amazon-inspector

Package name typosquats async-mutex but ships unrelated functionality. The default export getPlugin in index.js issues an HTTP request to a hardcoded bare IP endpoint (http://46.183.25.232:45000/icons/108) and passes the response's credits field into new Function('require','module',...,'Promise', data.credits), executing attacker-controlled JavaScript with Node privileges (access to require, process, Buffer). Cover-story variable names (IconProvider, iconDomain referencing cloudflare/fastly/akamai/gcore, path /ajax/libs/font-awesome/..., header bearrtoken: 'logo') frame the code as an icon CDN helper, while the actually-used path hits the bare IP. Declared dependencies (better-sqlite3, @primno/dpapi, node-machine-id) are consistent with a credential-stealer post-exploitation pipeline. Any consumer that requires this package and invokes the default export executes whatever JavaScript the remote server returns.