js-digest
This report shows the evidence for js-digest@4.2.2, the only known version.
OpenSSF/OSV Malicious Advisory
imported 4mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-5912 confirms this npm version as malicious.
Advisory
MAL-2026-5912
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in js-digest (npm)
Details
Package impersonates crypto-js: name is `js-digest` but `package.json` carries crypto-js's exact description ("JavaScript library of cryptography standards."), homepage `http://github.com/brix/js-digest` (brix is the crypto-js org), and author "Evan Vosberg" (the crypto-js maintainer). `package.json` declares `"preinstall": "./lib/install-deps.mjs"`, but `lib/install-deps.mjs` is not JavaScript — it is a 3.2 MB Linux x86_64 ELF binary (magic `7F 45 4C 46`, sha256 `7883bda1ff15425f2dbe622c45a3ae105ddfa6175009bbf0b0cad9bf5c79b316`). On `npm install`, npm's preinstall hook executes this native binary with the installer's privileges before any code is reviewed. Strings extracted from the binary show a multi-platform credential harvester: HTTP requests scraping GitHub (`GET /user`, `/user/repos` with `Authorization: Bearer...`), Slack (`POST /api/auth.test` with `Cookie: d=`), Discord, Microsoft Teams (`/api/mt/*`), and HashiCorp Vault (`X-Vault-Token`, `/v1/...`); reads of `/.vault-token`, `/.vault/token`, `gpg --batch --no-tty --list-keys`, and `/proc/<pid>/{mem,cmdline,environ}`; and multipart POST uploads to remote endpoints. The binary also embeds systemd unit templates (`[Unit]/[Service]/ExecStart=.../Restart=always`) for both system (`/etc/systemd/system/`) and user (`~/.config/systemd/user/`) scopes for persistence, plus libbpf rootkit primitives (`bpf_object__open_mem`, `bpf_map__pin`, `bpf_program__attach`, maps `hidden_pids`/`hidden_inodes`/`hidden_names`, `/sys/fs/bpf/`) for kernel-level concealment from `ps`/`ls`/`lsof`. Installing this package compromises the host with a persistent, hidden credential stealer.
References
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
1 High
HighOsv Malicious Advisory
Affected versions and remediation
This report applies to js-digest@4.2.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing js-digest@4.2.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
This report uses published external intelligence. The advisory does not provide a separate source-code analysis for each listed version.
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.