{"answers":{"affected":"1 open source package ship an affected version, including procwire.","exploited":"There is no known exploitation of MAL-2026-6687 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-6687 is a malicious package in procwire, published on 30 Jun 2026."},"fix_prompt":"MAL-2026-6687 is a malicious package: procwire (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-6687/ (Markdown: https://insights.sbomify.com/MAL-2026-6687/index.md)","id":"MAL-2026-6687","markdown":"https://insights.sbomify.com/MAL-2026-6687/index.md","name":"MAL-2026-6687","record":{"aliases":["GHSA-5r42-357x-f2mx"],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"On Windows, installing procwire@2.0.0 automatically downloads and executes an attacker-controlled executable. The package.json `preinstall` script runs lib/setup.js, which platform-gates to win32, then constructs a download URL by XOR-decoding values pulled from two floating-version sibling packages (`endpointmap: \"*\"` and `bytecraft: \"*\"`) — splitting the C2/payload reference across separate packages so it can be rotated post-publication without modifying procwire itself. lib/worker.js obfuscates every sensitive identifier through `String.fromCharCode.apply(null, [...])` arrays — the strings 'https', 'child_process', 'spawn', 'curl.exe', 'bitsadmin', 'powershell.exe', 'cmd.exe', ':Zone.Identifier', the fake update filename prefixes, and the `Microsoft-Delivery-Optimization/10.0` User-Agent are all assembled at runtime to defeat static analysis. The download uses a three-tier fallback (Node https, curl.exe, bitsadmin) with TLS verification disabled (`rejectUnauthorized: false`) and ranged-resume support, saves the binary to `%LOCALAPPDATA%\\Temp` under names such as `msedge_update_*.exe`, `chrome_installer_*.exe`, or `teams_update_*.exe`, strips the Mark-of-the-Web `:Zone.Identifier` alternate data stream to bypass SmartScreen, then spawns the executable hidden and detached (`detached: true, stdio: 'ignore', windowsHide: true`). The advertised purpose of procwire is a process-IPC library, which has no need to fetch or execute any external binary. The combination — preinstall lifecycle hook, win32 gating, split-payload URL via wildcard siblings, identifier obfuscation, TLS-verify disabled, fake update filenames, MOTW stripping, hidden execution — is unambiguous malware behavior.\n\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in procwire (npm)","id":"MAL-2026-6687","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":["0"],"last_affected":[],"package":"procwire","purl":"pkg:npm/procwire","source":"MAL-2026-6687"}],"products":null,"published":"2026-06-30","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-6687/"}