{"answers":{"affected":"1 open source package ship an affected version, including core-js-buffer.","exploited":"There is no known exploitation of MAL-2026-13945 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-13945 is a malicious package in core-js-buffer, published on 13 Aug 2026."},"fix_prompt":"MAL-2026-13945 is a malicious package: core-js-buffer (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-13945/ (Markdown: https://insights.sbomify.com/MAL-2026-13945/index.md)","id":"MAL-2026-13945","markdown":"https://insights.sbomify.com/MAL-2026-13945/index.md","name":"MAL-2026-13945","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The package's postinstall script (package.json declares \"postinstall\": \"node init.js\") performs two hostile actions at install time. First, init.js POSTs installer host and user identifiers — os.hostname(), os.userInfo().username, os.platform(), architecture, Node version, OS release, package name/version, and timestamp — to https://core-js-buffer.domaup-com.workers.dev/report with TLS verification disabled (rejectUnauthorized: false). Second, it fetches an AES-256-GCM encrypted blob from https://core-js-buffer.domaup-com.workers.dev/e, decrypts it with a key derived from a fixed seed, writes the resulting Python code under ~/.cache/core-js-buffer/modules/, and spawns a detached Python process to execute it. Execution is gated by a dev-machine check (presence of Desktop/Documents/Downloads directories) to skip CI/sandbox environments, throttled to at most once per day via a cached marker, and only runs if the decrypted payload contains the string 'TelemetrySender' — evasion controls consistent with a malicious dropper rather than declared telemetry. The package name mimics core-js, a widely used JavaScript polyfill library.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in core-js-buffer (npm)","id":"MAL-2026-13945","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"core-js-buffer","purl":"pkg:npm/core-js-buffer","source":"MAL-2026-13945"}],"products":null,"published":"2026-08-13","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-13945/"}