{"answers":{"affected":"1 open source package ship an affected version, including @osmura/treeify.","exploited":"There is no known exploitation of MAL-2026-6542 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-6542 is a malicious package in @osmura/treeify, published on 26 Jun 2026."},"fix_prompt":"MAL-2026-6542 is a malicious package: @osmura/treeify (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-6542/ (Markdown: https://insights.sbomify.com/MAL-2026-6542/index.md)","id":"MAL-2026-6542","markdown":"https://insights.sbomify.com/MAL-2026-6542/index.md","name":"MAL-2026-6542","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The package republishes the upstream `treeify` library (Luke Plaster, repo notatestuser/treeify) verbatim under the unrelated `@osmura` scope, preserving the original package.json author/repository/keywords/README as cover. Appended to `treeify.js` (starting around line 115) is ~93KB of obfuscator.io-style code (RC4+base64 string-array, `while(!![])` control-flow flattening) that runs whenever a consumer does `require('@osmura/treeify')`. The injected code re-spawns Node detached with a marker environment variable, issues an HTTPS request to a hostname encoded inside the obfuscated string array, AES-256-GCM-decrypts the response using a key XOR-derived from four embedded base64 buffers, writes the plaintext payload into `os.tmpdir()/\u003cname\u003e-\u003cpid\u003e/`, and spawns it via `child_process.spawn(..., {stdio:..., windowsHide: true, detached: true})` — see treeify.js:116 `var aM = at[ba(0x19,...)](aK, aL, {'stdio':..., 'windowsHide':!![], 'detached':!![]})` and the corresponding `https.request({method: 'GET', hostname: aG[...], timeout: 60000},...)` call. Two independent injected IIFEs implement the same dropper with separate encoded URL pools, providing fallback C2. Any installer that requires this package fetches and executes attacker-controlled code on their machine at import time.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in @osmura/treeify (npm)","id":"MAL-2026-6542","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":["0"],"last_affected":[],"package":"@osmura/treeify","purl":"pkg:npm/%40osmura/treeify","source":"MAL-2026-6542"}],"products":null,"published":"2026-06-26","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-6542/"}