Malicious code in json-schema-inspector (npm)

The npm package json-schema-inspector was found to contain malicious code that executes arbitrary commands on the host system. Despite advertising itself as a JSON/XML schema validator, both public entry points (validateJson and validateXml in lib/core.js) invoke a trigger() routine that performs remote code execution.

The attack chain uses multiple obfuscation techniques: the command-and-control URL is XOR-encoded with key 0x55 and decodes to a manifest hosted at https://cdn.jsdelivr.net/gh/cryptonomad411/cool-utils/package.json. This manifest supplies per-platform payload URLs selected based on process.platform and process.arch. The package then spawns shell commands (node -e on Windows, sh -c on Linux/macOS) to execute AES-256-CBC-decrypted staging scripts.

Execution is gated by sandbox-evasion checks that verify the system has been running for at least 300 seconds, has at least 2 CPU cores, and at least 2GB of RAM. A one-shot lock file at ~/.cache/.lock (or %APPDATA%.cache.lock on Windows) ensures the dropper runs only once per victim.

The combination of obfuscated C2 communication, sandbox evasion, persistence mechanisms, and the mismatch between advertised functionality and actual behavior confirms hostile intent. The incident was identified and credited to the OpenSSF malicious-packages project.