dsh-moss-console@3.3.0
OpenSSF/OSV Malicious Advisory
imported 2d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18522 confirms this npm version as malicious.
Advisory
MAL-2026-18522
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in dsh-moss-console (npm)
Details
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
References
Independent LPM AI assessment
CleanIndependent AI assessment: clean. LPM AI assessed this version as clean; the assessments disagree.
The inspected source uses system metrics and the plugin's account balance for its stated wallpaper display, with local storage and a loopback data server. Runtime downloads and wallpaper launch require explicit UI actions; the bundled elevated batch launcher has a hard-coded developer path, but no hidden install or import-time attack was found.
Static reason
No blocking static signals were detected.
Trigger
Plugin activation starts the local data service; wallpaper installation and launch require UI POST actions.
Impact
Local status and balance are displayed and cached locally; no unrelated data collection or external telemetry was identified.
Mechanism
Reads system metrics and the plugin's account balance for display, writes balance data locally, and serves live data on loopback. A user-triggered installer downloads Electron and Koffi.
AI rationale
The inspected source uses system metrics and the plugin's account balance for its stated wallpaper display, with local storage and a loopback data server. Runtime downloads and wallpaper launch require explicit UI actions; the bundled elevated batch launcher has a hard-coded developer path, but no hidden install or import-time attack was found.
Evidence
MOSS_DATA_DIR/balance.jsonwallpaper/electron-download.zipwallpaper/node_modules/electron/distwallpaper/node_modules/koffi
Network endpoints3
127.0.0.1:17800registry.npmjs.org/koffi/-/koffi-2.16.3.tgz/mirrors/electron/33.4.11/electron-v33.4.11-win32-x64.zip
Independent scan evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes a Windows wallpaper plugin that displays local system status and account balance.
- The plugin reads system metrics and the account balance for its display, then writes the balance to a local balance.json file.
- The live data server binds to 127.0.0.1:17800.
- Runtime installation is initiated by a UI action that sends a POST request; it downloads Electron and Koffi from the URLs named in the source.
- The bundled batch launcher is separate from package activation, and its source contains an explicit Start-Process -Verb RunAs command with a hard-coded developer path.
Evidence against
- The native MossWallpaper.exe is an unsupported PE binary, so its contents could not be inspected directly.
- The batch launcher uses a hard-coded developer path and requests elevation when manually launched.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStrings
Source & flagged code
6 flaggedindex.jsView file
8L9: import { execFile, spawn } from 'node:child_process';
L10: import fs from 'node:fs';
High
8L9: import { execFile, spawn } from 'node:child_process';
L10: import fs from 'node:fs';
L11: import net from 'node:net';
L12: import { existsSync, readdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
...
L20:
L21: const SLEEP_AFTER_MS = Number(process.env.MOSS_SLEEP_SEC || 0) * 1000 || 600_000;
L22: const FORCE_SLEEP = process.env.MOSS_FORCE_SLEEP === '1';
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
index.jsView on unpkg · L8wallpaper/MossWallpaper.exeView file
•path = wallpaper/MossWallpaper.exe
kind = native_binary
sizeBytes = 7680
magicHex = [redacted]
Findings
4 High5 Medium3 Low
HighChild Processindex.js
HighSame File Env Network Executionindex.js
HighSemantic Analysis Limitedicon.svg
HighAi Review Evidencepackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binarywallpaper/MossWallpaper.exe
MediumShips Build Helperwallpaper/launch.bat
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to dsh-moss-console@3.3.0.
See all versions of dsh-moss-console for other recorded verdicts.
- Avoid installing dsh-moss-console@3.3.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.