MAL-2026-14282 Malicious code in mutex-plus (npm)

lib/Mutex.js contains a hidden branch inside runExclusive() that, when a callback object carries a meta.jobId whose sha256 equals a hardcoded value (6cdda0ba143b3bee5949d3d45d2145c53c02abfe0e742465cdce2c0393e94d7f), invokes decryptToFile() from an obfuscated helper lib/common.js to AES-256-GCM-decrypt the shipped lib/plusMutex.min.js using the caller-supplied jobId as the key, then spawns the decrypted file via node as a detached, stdio-ignored, windowsHide child process. lib/common.js is a string-array + index-rotation obfuscated module wrapping scryptSync + createDecipheriv + writeFileSync; it is required only from this hidden branch. lib/plusMutex.min.js (16.9 KB, sha256 903169c2602ad15ba2dbc3c1e791bd26561958508d7d8a7ce35fc7d53c6212e1) is the AES-256-GCM ciphertext; sibling files lib/plusMutex.min.d.js (862 KB) and lib/tryAcquireMutex.min.d.js use a fabricated .d.js extension (real TypeScript declarations are .d.ts) to disguise executable/binary content as declaration artifacts. A mutex primitive has no functional need for encrypted-at-rest sibling blobs, an obfuscated GCM decryptor, or a hash-gated detached node spawn. The construction gives whoever holds the correct jobId — the decryption key — remote code execution on any consumer of Mutex.runExclusive that receives a crafted callback object, with the payload undecryptable without that key.