# MAL-2026-6401: Malicious code in zenith-utils (npm)


- **Type:** Malicious package
- **Package:** `zenith-utils` (npm)
- **Published:** 24 Jun 2026

## What is MAL-2026-6401?

MAL-2026-6401 is a malicious package in zenith-utils, published on 24 Jun 2026. 

### Official description

Package name is zenith-utils but the tarball is a verbatim copy of the nodemailer source tree (lib/nodemailer.js as main, lib/smtp-transport, lib/ses-transport, lib/dkim, lib/mail-composer, etc.; package.json author set to nodemailer's real maintainer 'Andris Reinman'). package.json declares `postinstall: node lib/utils/index.js`, which uses spawn with `detached: true`, `stdio: ['ignore','ignore','ignore']`, and `child.unref()` to launch lib/utils/smtp-connection/index.js as a hidden background process that survives the npm install command. That process forks lib/utils/smtp-connection/worker.js, which polls `https://jsonkeeper.com/b/WDH3V` in an infinite loop and executes the returned `cookie` field via `new Function('require', r.data.cookie)(require)`. jsonkeeper.com is an anonymous, mutable paste host — the author can change the served payload at any time, granting arbitrary Node-privileged code execution on every machine that has installed the package. The detached/unref'd spawn is deliberately designed to hide the activity from npm's lifecycle logs while the eval loop runs persistently in the background.

## What should I do about MAL-2026-6401?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-6401 is a malicious package: zenith-utils (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-6401/ (Markdown: https://insights.sbomify.com/MAL-2026-6401/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-6401

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-6401/
Summaries are generated and may contain mistakes; the official description above is the record.