{"answers":{"affected":"1 open source package ship an affected version, including caspian-day-js.","exploited":"There is no known exploitation of MAL-2026-5892 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-5892 is a malicious package in caspian-day-js, published on 16 Jun 2026."},"fix_prompt":"MAL-2026-5892 is a malicious package: caspian-day-js (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-5892/ (Markdown: https://insights.sbomify.com/MAL-2026-5892/index.md)","id":"MAL-2026-5892","markdown":"https://insights.sbomify.com/MAL-2026-5892/index.md","name":"MAL-2026-5892","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"caspian-day-js impersonates the popular dayjs package: package.json copies author `iamkun`, homepage `day.js.org`, and repo `github.com/iamkun/dayjs.git`, and ships an unmodified `dayjs.min.js` as `main` so `require('caspian-day-js')` appears functional. The malicious payload is in the lifecycle hook: package.json declares `postinstall: node setup.cjs`. setup.cjs is heavily obfuscated (obfuscator.io-style string-array with a custom base64 decoder) and at install time sets `NODE_TLS_REJECT_UNAUTHORIZED='0'`, fetches a remote JavaScript payload, writes it to `\u003ctmpdir\u003e/\u003c12-hex\u003e.js`, then spawns `process.execPath` on the dropped file (detached, stdio:'ignore', windowsHide:true) with the C2 endpoint `23.254.164.123:443` passed as argv[1], and finally unlinks setup.cjs to erase traces. Every machine running `npm install caspian-day-js` executes attacker-controlled JavaScript with TLS verification disabled, contacting 23.254.164.123:443.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in caspian-day-js (npm)","id":"MAL-2026-5892","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"caspian-day-js","purl":"pkg:npm/caspian-day-js","source":"MAL-2026-5892"}],"products":null,"published":"2026-06-16","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-5892/"}