OpenSSF/OSV advisory MAL-2026-12339 confirms this npm version as malicious. Package is published under the name async-mutex-hook and self-describes as a Promise-based mutex library, but ships no mutex implementation. Its exported getPlugin function issues an HTTPS request to the hardcoded bare-IP endpoint https://46.183.25.232:45000/icons/108 and passes the response's `credits` field to `new Function('require','module','exports',...,'Promise', data.credits)`, executing attacker-controlled...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in async-mutex-hook (npm)
Details
Package is published under the name async-mutex-hook and self-describes as a Promise-based mutex library, but ships no mutex implementation. Its exported getPlugin function issues an HTTPS request to the hardcoded bare-IP endpoint https://46.183.25.232:45000/icons/108 and passes the response's `credits` field to `new Function('require','module','exports',...,'Promise', data.credits)`, executing attacker-controlled JavaScript with full Node.js privileges (require, process, Buffer, and shipped dependencies injected). The declared dependencies (@primno/dpapi for Windows DPAPI, better-sqlite3/sqlite3 for browser cookie and login databases, node-machine-id) are unrelated to any mutex functionality and are the standard building blocks for browser-credential and DPAPI theft, matching the capability the remote payload would need to invoke on the installer's host.
Decision reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review