{"answers":{"affected":"1 open source package ship an affected version, including mxdriver.","exploited":"There is no known exploitation of MAL-2026-16383 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-16383 is a malicious package in mxdriver, published on 22 Sep 2026."},"fix_prompt":"MAL-2026-16383 is a malicious package: mxdriver (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-16383/ (Markdown: https://insights.sbomify.com/MAL-2026-16383/index.md)","id":"MAL-2026-16383","markdown":"https://insights.sbomify.com/MAL-2026-16383/index.md","name":"MAL-2026-16383","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The npm package mxdriver@0.0.2 ships obfuscator.io-style string-array-obfuscated preinstall and postinstall scripts (scripts/preinstall.js, scripts/postinstall.js). On npm install, the decoded scripts fetch remote content from api.imghippo.com (an anonymous third-party image host, e.g. https://api.imghippo.com/files/hOG8244hc.png) and a second URL under www.image.com/, write the bytes into the package directory as gldriver_pre_asset.exe and gldriver_pre_core.exe, then invoke a platform-specific opener against the.exe path via child_process.exec (`mspaint \"...\"` on win32, `open \"...\"` on darwin, `xdg-open \"...\"` on linux), and delete the files. The README frames the package as a Google APIs wrapper, which does not correspond to downloading and opening.exe files at install time. The delivery source is mutable and non-publisher, no hash or signature is verified, the destination filename is an executable extension, and the URLs, filenames, and shell commands are all hidden behind a rotated string-array accessor (`_0x5c7e`) — a classic install-time dropper pattern whose payload can be swapped at any time by whoever controls the imghippo asset.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in mxdriver (npm)","id":"MAL-2026-16383","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"mxdriver","purl":"pkg:npm/mxdriver","source":"MAL-2026-16383"}],"products":null,"published":"2026-09-22","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-16383/"}