OpenSSF/OSV advisory MAL-2026-13360 confirms this npm version as malicious. The CJS entry (dist/index.cjs) assembles a scrypt password by XOR-deobfuscating three sibling byte arrays (_a.cjs, _b.cjs, _c.cjs) with distinct constants (17, 91, 53), uses that key with createDecipheriv('aes-256-cbc',...) to decrypt an embedded ~5KB ciphertext, and passes the plaintext to new Function('module','exports','require','__dirname','__filename',...)(...) — executing opaque code in the consumer's Node...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in uzair-rajput-new (npm)
Details
The CJS entry (dist/index.cjs) assembles a scrypt password by XOR-deobfuscating three sibling byte arrays (_a.cjs, _b.cjs, _c.cjs) with distinct constants (17, 91, 53), uses that key with createDecipheriv('aes-256-cbc',...) to decrypt an embedded ~5KB ciphertext, and passes the plaintext to new Function('module','exports','require','__dirname','__filename',...)(...) — executing opaque code in the consumer's Node process on every require('uzair-rajput-new'). The parallel ESM build (dist/index.js) is a plain color-gradient library containing no such loader, so the obfuscated dynamic-code loader is not a legitimate transpilation artifact of the declared TypeScript source. The split-key layout, XOR obfuscation of key material, and AES-encrypted payload together constitute an anti-analysis packaging pattern whose only effect is to hide arbitrary code executed at module load.
Decision reason
OpenSSF Malicious Packages via OSV confirms uzair-rajput-new@1.0.1 as malicious (MAL-2026-13360): Malicious code in uzair-rajput-new (npm)