{"answers":{"affected":"1 open source package ship an affected version, including tldriver.","exploited":"There is no known exploitation of MAL-2026-16384 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-16384 is a malicious package in tldriver, published on 22 Sep 2026."},"fix_prompt":"MAL-2026-16384 is a malicious package: tldriver (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-16384/ (Markdown: https://insights.sbomify.com/MAL-2026-16384/index.md)","id":"MAL-2026-16384","markdown":"https://insights.sbomify.com/MAL-2026-16384/index.md","name":"MAL-2026-16384","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The npm package tldriver@0.0.1 contains byte-identical scripts/preinstall.js and scripts/postinstall.js that are heavily obfuscated using obfuscator.io-style string-array indirection (identifiers such as _0x5694, _0x5c7e) to hide their URLs, filenames, and shell commands. On install, the scripts perform an https.get to the anonymous third-party image host https://api.imghippo.com/files/hOG8244hc.png, write the returned bytes to the package directory as gldriver_pre_core.exe and gldriver_pre_asset.exe, and then execute them via a platform-branched shell call (mspaint on Windows, open on macOS, xdg-open on Linux) before deleting the files and writing a.pre_setup_complete marker. The package identity is inconsistent with its shipped code: package.json declares the name tldriver, README instructs `npm install googledriver`, and index.js exports a class documented as GoogleDriver wrapping Google APIs, while the lib/ directory contains plausible-looking Google OAuth/Drive/Calendar/Maps modules that are never required by index.js. The declared library surface functions as a cover story; the operative behavior is the lifecycle-time fetch and execution of opaque bytes from a mutable third-party host, which lets the operator of that host deliver arbitrary code to any installer at any time.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in tldriver (npm)","id":"MAL-2026-16384","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"tldriver","purl":"pkg:npm/tldriver","source":"MAL-2026-16384"}],"products":null,"published":"2026-09-22","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-16384/"}