OpenSSF/OSV advisory MAL-2026-14175 confirms this npm version as malicious. The package's postinstall hook (`package.json` → `node init.js`) runs an installer-side dropper. init.js gates on developer-machine heuristics (presence of Desktop/Documents/Downloads directories) and a 24-hour skip marker, then POSTs hostname, username, platform, architecture, Node version, OS release, and package name/version to https://core-js-buffer.domaup-com.workers.dev/report...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in core-js-gns (npm)
Details
The package's postinstall hook (`package.json` → `node init.js`) runs an installer-side dropper. init.js gates on developer-machine heuristics (presence of Desktop/Documents/Downloads directories) and a 24-hour skip marker, then POSTs hostname, username, platform, architecture, Node version, OS release, and package name/version to https://core-js-buffer.domaup-com.workers.dev/report. It then HTTP GETs an AES-256-GCM ciphertext from the same host with TLS verification disabled (`rejectUnauthorized: false`), decrypts it with a key derived from a hardcoded seed, checks the plaintext contains the cover-story string `TelemetrySender`, writes the result to `~/.cache/core-js-buffer/modules/runtime.py`, and spawns Python detached (`stdio:'ignore'`, `.unref()`) to execute it. The package name mimics the legitimate `core-js` library. Behavior is arbitrary remote code execution on the installer's machine, fetched from an attacker-controlled endpoint at npm install time, preceded by installer identifier exfiltration to the same endpoint.
Decision reason
OpenSSF Malicious Packages via OSV confirms core-js-gns@1.0.0 as malicious (MAL-2026-14175): Malicious code in core-js-gns (npm)