MAL-2026-19142: Malicious code in fcefi-wdojs-util (npm)
--- -= Per source details. Do not edit below this line.=-
Source: amazon-inspector (07a00a17209ccc173a7196dd8e97486609819945db1459a5333463be9f6c20b9) fcefi-wdojs-util@1.0.0 ships a loader in index.js that reads an undeclared bz numeric array (~1000 bytes) from its own package.json, zlib-inflates it, and executes the resulting JavaScript via the Function constructor on every require of the package. The loader is wrapped in an IIFE that explicitly short-circuits when any of CI, GITHUBACTIONS, GITLABCI, TRAVIS, CIRCLECI, or SANDBOX are set in the environment, so the payload only runs on developer and production hosts and stays inert in scanning environments. Adjacent to the loader, lib/native.pkgconfig is a 2,890,302-byte file containing only hex characters with no printable strings and no relation to native code or pkg-config, consistent with an encrypted stage-2 payload decrypted by the inflated bytecode. The combination — executable code smuggled inside the manifest as a non-standard field, require-time Function()-based execution, deliberate CI/sandbox evasion, and a large opaque hex blob shipped as a misleadingly named config file — is a multi-stage dropper with no legitimate utility function.
Affected Software
Event History
Frequently Asked Questions
When does the malicious payload execute?
The loader executes the inflated JavaScript through the Function constructor every time the package is required. It short-circuits only when CI, GITHUB_ACTIONS, GITLAB_CI, TRAVIS, CIRCLECI, or SANDBOX is set.
Why might CI-based dependency checks fail to reveal this behavior?
The package explicitly suppresses payload execution when several common CI and sandbox environment variables are present. As a result, the malicious behavior can remain inert during automated scanning while running on developer or production hosts.
How can I identify an installed affected package?
Inspect fcefi-wdojs-util@1.0.0 for an undeclared _bz numeric array in package.json and an index.js loader that zlib-inflates it and invokes Function(). Also check for the unusually large lib/native.pkg_config file, which is 2,890,302 bytes and contains only hexadecimal characters.