MAL-2026-5892 Malicious code in caspian-day-js (npm)
Malicious package
Published
MAL-2026-5892 is a malicious package: caspian-day-js (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-5892/ (Markdown: https://insights.sbomify.com/MAL-2026-5892/index.md)
- Package
- caspian-day-js
- Registry
- npm
What is MAL-2026-5892?
MAL-2026-5892 is a malicious package in caspian-day-js, published on 16 Jun 2026.
Official description
caspian-day-js impersonates the popular dayjs package: package.json copies author
iamkun, homepage day.js.org, and repo github.com/iamkun/dayjs.git, and ships an unmodified dayjs.min.js as main so require('caspian-day-js') appears functional. The malicious payload is in the lifecycle hook: package.json declares postinstall: node setup.cjs. setup.cjs is heavily obfuscated (obfuscator.io-style string-array with a custom base64 decoder) and at install time sets NODE_TLS_REJECT_UNAUTHORIZED='0', fetches a remote JavaScript payload, writes it to <tmpdir>/<12-hex>.js, then spawns process.execPath on the dropped file (detached, stdio:'ignore', windowsHide:true) with the C2 endpoint 23.254.164.123:443 passed as argv[1], and finally unlinks setup.cjs to erase traces. Every machine running npm install caspian-day-js executes attacker-controlled JavaScript with TLS verification disabled, contacting 23.254.164.123:443.What should I do about MAL-2026-5892?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.