{"answers":{"affected":"1 open source package ship an affected version, including events-runtime.","exploited":"There is no known exploitation of MAL-2026-5528 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-5528 is a malicious package in events-runtime, published on 10 Jun 2026."},"fix_prompt":"MAL-2026-5528 is a malicious package: events-runtime (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-5528/ (Markdown: https://insights.sbomify.com/MAL-2026-5528/index.md)","id":"MAL-2026-5528","markdown":"https://insights.sbomify.com/MAL-2026-5528/index.md","name":"MAL-2026-5528","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Package name and description impersonate the popular `events` package (Node's event emitter for all engines). The vendored `events.js` adds an undocumented branch in `EventEmitter.prototype.emit`: when an emitted event's first argument has `eventId == 'eventId0'`, line 160 spawns a detached `node tests/galas-emit.min.js` with `stdio: 'ignore'` and `windowsHide: true`. tests/galas-emit.min.js is heavily obfuscated (obfuscator.io-style string-array indirection, base64-encoded RPC URLs and contract address) and performs three hostile actions: (1) connects to Ethereum Sepolia via Infura/Alchemy and calls `getCwPrivatePublic` / `getTData1` / `getTData2` on contract `0x661e50E19f05E3c0d04fD75891456D1F0A24508D`, AES-GCM/PBKDF2-decrypts the returned ciphertext, writes it to `tests/galas.min.js`, `chmodSync` 755 and executes it with `process.execPath` — the contract owner can rotate the executed payload at any time via a blockchain transaction; (2) builds a system report (platform, OS release, arch, hostname, CPU count, memory, uptime) and POSTs it to `slack.com/api/chat.postMessage` with hardcoded bot token `xoxb-11307403103236-...` and to `api.telegram.org/bot8961878831:.../sendMessage` with hardcoded chat id `-1003952553968`; (3) spawns `tests/errors.min.js`, which polls `conversations.history` every 10s on Slack channel `C0B8GEPFMK9` with bot token `xoxb-11301867762550-...`, AES-GCM-decrypts chunked messages from a specific user/bot, reassembles them into `tests/galas.min.js`, chmods 755 and executes it — a persistent post-install RCE channel. A magic `exitexitexit` message triggers anti-forensics: `fs.unlinkSync` of `events.js`, `galas-emit.min.js`, `errors.min.js`, `galas.min.js`, splices 16 lines out of LICENSE, scrubs the redistribution clause from package.json, and issues `taskkill /PID /T /F` (Windows) or SIGTERM (Unix). This is a fully attacker-controlled remote-code-execution and reconnaissance backdoor disguised as an EventEmitter polyfill.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in events-runtime (npm)","id":"MAL-2026-5528","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"events-runtime","purl":"pkg:npm/events-runtime","source":"MAL-2026-5528"}],"products":null,"published":"2026-06-10","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-5528/"}