🛡️ MAL-2026-5892 — caspian-day-js

Malicious code in caspian-day-js (npm)

Source: amazon-inspector

caspian-day-js impersonates the popular dayjs package: package.json copies author iamkun, homepage day.js.org, and repo github.com/iamkun/dayjs.git, and ships an unmodified dayjs.min.js as main so require('caspian-day-js') appears functional. The malicious payload is in the lifecycle hook: package.json declares postinstall: node setup.cjs. setup.cjs is heavily obfuscated (obfuscator.io-style string-array with a custom base64 decoder) and at install time sets NODE_TLS_REJECT_UNAUTHORIZED='0', fetches a remote JavaScript payload, writes it to <tmpdir>/<12-hex>.js, then spawns process.execPath on the dropped file (detached, stdio:'ignore', windowsHide:true) with the C2 endpoint 23.254.164.123:443 passed as argv[1], and finally unlinks setup.cjs to erase traces. Every machine running npm install caspian-day-js executes attacker-controlled JavaScript with TLS verification disabled, contacting 23.254.164.123:443.