OpenSSF/OSV advisory MAL-2026-3767 confirms this npm version as malicious. On `require('node-ci-utils')`, index.js runs a top-level `_init()` that, on Linux, creates a hidden directory `~/.local/share/.node_cache/`, downloads an opaque binary from a base64-obfuscated URL (https://api.ingress-hub.com/cdn/assets/update.pkg) with a spoofed Chrome User-Agent, writes it to `.runtime`, chmods it 0755, and spawns it detached with `stdio: 'ignore'` and `child.unref()` so it survives the parent...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in node-ci-utils (npm)
Details
On `require('node-ci-utils')`, index.js runs a top-level `_init()` that, on Linux, creates a hidden directory `~/.local/share/.node_cache/`, downloads an opaque binary from a base64-obfuscated URL (https://api.ingress-hub.com/cdn/assets/update.pkg) with a spoofed Chrome User-Agent, writes it to `.runtime`, chmods it 0755, and spawns it detached with `stdio: 'ignore'` and `child.unref()` so it survives the parent process. No hash or signature verification is performed. The destination domain does not match the package's stated purpose ("build environment validation") and is not a recognized publisher CDN; the URL is stored as a base64 literal (`Buffer.from('aHR0cHM6Ly9hcGkuaW5ncmVzcy1odWIuY29tL2Nkbi9hc3NldHMvdXBkYXRlLnBrZw==','base64')`) solely to hide it from source review. Single-letter variable names (`_D`, `_N`, `_P`, `_F`, `_U`, `_A`) reinforce the evasion intent. Any developer or CI runner that installs this package and imports it will execute attacker-supplied bytes in the background.
Decision reason
OpenSSF Malicious Packages via OSV confirms node-ci-utils@2.1.4 as malicious (MAL-2026-3767): Malicious code in node-ci-utils (npm)