mal-2026-16052
Vulnerability from ossf_malicious_packages
Published
2026-09-08 21:56
Modified
2026-09-09 07:22
Summary
Malicious code in open-item-validator (npm)
Details
-= Per source details. Do not edit below this line.=-
Source: amazon-inspector (7ba5b55d57f4938bf2494d369d14434bb80ba6f6c712c7f8d89ae773c27dc457)
On require(), index.js spawns a detached, unref'd background Node process (lib/check-items.js) that repeatedly HTTP-GETs a JSON payload from http://itemx.servegame.com:8888/api/x-realtime and executes the returned JavaScript via new Function('require','module', payload.code)(require, moduleObj). The daemon survives the parent process and re-polls the endpoint on a configured interval, so whoever controls that endpoint runs arbitrary Node code on the installer's host on library load and continuously thereafter. The fetch is over plain HTTP to a No-IP dynamic-DNS host (servegame.com) that does not match the publisher's declared homepage (game.spawnrealm.com); a bundled RSA signature check does not alter that the endpoint operator chooses what code runs. README framing as 'signed game code updates' is inconsistent with the shipped generic fetch-and-exec mechanism and the publisher/destination host mismatch.
CWE
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
- CWE-506 - The product contains code that appears to be malicious in nature.
Credits
{
"affected": [
{
"database_specific": {
"cwes": [
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
}
],
"indicators": {
"evidence_files": [
{
"path": "lib/check-items.js",
"sha256": "4b73aed06386ca7d176db5e8da14cdcf33a78e9d25b2d5ae31a6206133a246a0",
"tlsh": "3491734ead4b92371eb742f44317502afb5e91932691d205bbcdd34c2fb8118e325cea"
},
{
"path": "index.js",
"sha256": "0f036bd6bbfba26d056465135e91d99bd428210fdc42473ab463bae06e21a32e",
"tlsh": "d11121ea32caa52a7c32afe1e9338111be16c11277004001b9edbad60fe19864353cbd"
}
],
"package_integrity": [
{
"filename": "open-item-validator-1.0.3.tgz",
"hashes": {
"sha1": "e267496a8e5871b9b287b0646d1c0419ab98230b",
"sha512_sri": "sha512-iHtWqOLOZCP2tMXCKpKbeyZumJ0FoSEjwqLFnKULXIK9ja8IfhO4c1g6hivmHBfggM8ejgGZcfaOXW2Na5HGIQ=="
}
}
]
}
},
"package": {
"ecosystem": "npm",
"name": "open-item-validator"
},
"versions": [
"1.0.3",
"1.0.5",
"1.0.2",
"1.0.0",
"1.0.4",
"1.0.1"
]
}
],
"credits": [
{
"contact": [
"inspector-research@amazon.com"
],
"name": "Amazon Inspector",
"type": "FINDER"
}
],
"database_specific": {
"malicious-packages-origins": [
{
"id": "IN-MAL-2026-019720",
"import_time": "2026-09-08T22:15:50.407159479Z",
"modified_time": "2026-09-08T21:56:18Z",
"sha256": "7ba5b55d57f4938bf2494d369d14434bb80ba6f6c712c7f8d89ae773c27dc457",
"source": "amazon-inspector",
"versions": [
"1.0.3"
]
},
{
"id": "IN-MAL-2026-019719",
"import_time": "2026-09-08T22:15:50.366549708Z",
"modified_time": "2026-09-08T21:56:09Z",
"sha256": "ee1ac3d27c505e6a6e95a5544939630fdb29b701cbe41f095d7431cd4a2c83aa",
"source": "amazon-inspector",
"versions": [
"1.0.5"
]
},
{
"id": "IN-MAL-2026-019851",
"import_time": "2026-09-09T07:20:44.067356297Z",
"modified_time": "2026-09-09T06:58:04Z",
"sha256": "5969fb446f5d7799038ef9ba9fe8affe2a52fa4a4ead78972468dfbee8e5fb37",
"source": "amazon-inspector",
"versions": [
"1.0.2"
]
},
{
"id": "IN-MAL-2026-019853",
"import_time": "2026-09-09T07:20:44.254346612Z",
"modified_time": "2026-09-09T06:58:24Z",
"sha256": "644e4428fb51fc8b74e205a3115a7765fe004741a307179b71c91060b1bdbe2f",
"source": "amazon-inspector",
"versions": [
"1.0.0"
]
},
{
"id": "IN-MAL-2026-019854",
"import_time": "2026-09-09T07:20:44.367114832Z",
"modified_time": "2026-09-09T06:58:34Z",
"sha256": "6dd0888ad306ae546ce2b0d6a482de9139a165174d14ff4afeee199b87b77c5d",
"source": "amazon-inspector",
"versions": [
"1.0.4"
]
},
{
"id": "IN-MAL-2026-019852",
"import_time": "2026-09-09T07:20:44.1602428Z",
"modified_time": "2026-09-09T06:58:15Z",
"sha256": "fa5f923c619fb110019899ac88d32bfe2bd195fbffdcde853b618ae5be3f360e",
"source": "amazon-inspector",
"versions": [
"1.0.1"
]
}
]
},
"details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7ba5b55d57f4938bf2494d369d14434bb80ba6f6c712c7f8d89ae773c27dc457)\nOn require(), index.js spawns a detached, unref\u0027d background Node process (lib/check-items.js) that repeatedly HTTP-GETs a JSON payload from http://itemx.servegame.com:8888/api/x-realtime and executes the returned JavaScript via new Function(\u0027require\u0027,\u0027module\u0027, payload.code)(require, moduleObj). The daemon survives the parent process and re-polls the endpoint on a configured interval, so whoever controls that endpoint runs arbitrary Node code on the installer\u0027s host on library load and continuously thereafter. The fetch is over plain HTTP to a No-IP dynamic-DNS host (servegame.com) that does not match the publisher\u0027s declared homepage (game.spawnrealm.com); a bundled RSA signature check does not alter that the endpoint operator chooses what code runs. README framing as \u0027signed game code updates\u0027 is inconsistent with the shipped generic fetch-and-exec mechanism and the publisher/destination host mismatch.\n",
"id": "MAL-2026-16052",
"modified": "2026-09-09T07:22:46.801461535Z",
"published": "2026-09-08T21:56:09Z",
"references": [
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/open-item-validator/v/1.0.3"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/open-item-validator/v/1.0.5"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/open-item-validator/v/1.0.2"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/open-item-validator/v/1.0.0"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/open-item-validator/v/1.0.4"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/open-item-validator/v/1.0.1"
}
],
"schema_version": "1.7.4",
"summary": "Malicious code in open-item-validator (npm)"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…