MAL-2026-19146: Malicious code in teahy-znrpz-util (npm)

Published Nov 11, 2026

Updated

--- -= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5d18143cb6c6ab53a6b224630d1b50f00578f4308414da4f384281a679d7861d) index.js reads a numeric byte array stored under a non-standard bz key inside package.json, decompresses it with zlib.inflateSync, and executes the resulting string via the Function constructor with require and dirname bound in — all on module load. Execution is gated by an early-return when any of CI, GITHUBACTIONS, GITLABCI, TRAVIS, CIRCLECI, or SANDBOX environment variables are set, so the hidden code only runs on real developer or production hosts. Smuggling executable logic as a zlib blob under a private manifest key, decoding it, and running it through Function() at require time is an obfuscated-loader pattern; the package's self-description as a 'utility' does not match any behavior visible in its source. The payload executes with full Node privileges on the installer's machine as soon as the module is required.

Affected Software

1 affected component

npm/teahy-znrpz-util=1.0.0

Event History

Nov 11, 2026

Advisory Published

via OSV·09:03 PM

Data Sourced

via OSV·09:03 PM

DescriptionAffected Software

Frequently Asked Questions

Who is exposed to this package?

Any developer or production host that requires teahy-znrpz-util may be exposed. The hidden payload is designed not to run when CI, GITHUB_ACTIONS, GITLAB_CI, TRAVIS, CIRCLECI, or SANDBOX environment variables are set, so CI testing may not reveal the behavior.

What triggers execution of the malicious code?

The payload executes when the module is loaded with require, not merely when a particular exported utility is called. It is decompressed from the package manifest and run through the Function constructor with Node.js require and __dirname available.

What privileges does the payload have?

It runs with the full Node.js privileges of the process that loads the package. Its access therefore matches the permissions, credentials, files, network access, and environment variables available to that process.

How can I determine whether an environment is affected?

Check whether teahy-znrpz-util is present in the dependency tree or lockfile and whether it has been required on developer or production hosts. Review package.json for a non-standard _bz key and index.js for zlib.inflateSync followed by Function-based execution.

MAL-2026-19146: Malicious code in teahy-znrpz-util (npm)

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this package?

What triggers execution of the malicious code?

What privileges does the payload have?

How can I determine whether an environment is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this package?

What triggers execution of the malicious code?

What privileges does the payload have?

How can I determine whether an environment is affected?