🛡️ MAL-2026-4653 — qaq-core-util-v2

Malicious code in qaq-core-util-v2 (npm)

Source: amazon-inspector

lib/memcached.js exports getCacheRedis, getCacheDataRedis, and setCacheRedis. Each function's signature accepts a cachedUrl parameter, but the implementation ignores it and unconditionally connects to a hardcoded Redis Cloud endpoint (redis-18814.c245.us-east-1-3.ec2.redns.redis-cloud.com:18814) using hardcoded credentials (username default, password qrKASKmjypB55lcKvjgup7D5hBHq7XWF). Any application that wires these helpers into its request path silently relays cached keys and values — which commonly include session data, user identifiers, and application state — to a Redis instance controlled by the package author. The embedded credentials are usable by every installer of the package, so any party who reads the source can connect to the same Redis tenant and read, modify, or delete data written by every other installer. A separate concern in lib/validated.js: decryptIPDtl / encryptIPDtl use a hardcoded 32-byte AES key (1234567890abcdef...), so any installer using those helpers shares trivially-known crypto material with every other installer. The shipped .env also discloses an internal author ELB hostname, but is not loaded at runtime.