Malicious code in mutex-plus (npm)
The npm package mutex-plus contains hidden malicious code that enables remote code execution when a callback object with a specific jobId hash is passed to runExclusive(). The payload is encrypted at rest in lib/plusMutex.min.js and decrypted using the jobId as a key, then executed as a detached Node.js process.
- Disclosed
- Last updated
- Blast radius
- Any application using mutex-plus that receives a crafted callback object with the specific jobId hash; remote code execution possible on affected systems.
- Ecosystems
- Attack vectors
- Affected entities
- mutex-plusnpm package containing malicious code in lib/Mutex.js
The npm package mutex-plus was found to contain malicious code embedded in lib/Mutex.js. The code implements a hidden branch within the runExclusive() function that checks if a callback object carries a meta.jobId whose SHA256 hash matches a hardcoded value (6cdda0ba143b3bee5949d3d45d2145c53c02abfe0e742465cdce2c0393e94d7f).\n\nWhen triggered, the malicious code invokes a decryption function from an obfuscated helper module (lib/common.js) to AES-256-GCM-decrypt the shipped lib/plusMutex.min.js file using the caller-supplied jobId as the decryption key. The decrypted payload is then spawned as a detached Node.js child process with stdio ignored and windowsHide enabled, allowing covert execution.\n\nThe package includes additional obfuscation techniques: lib/common.js uses string-array and index-rotation obfuscation to hide its scryptSync, createDecipheriv, and writeFileSync operations. Two sibling files (lib/plusMutex.min.d.js and lib/tryAcquireMutex.min.d.js) use a fabricated .d.js extension instead of the standard .d.ts to disguise executable content as TypeScript declaration artifacts.\n\nThis construction provides remote code execution to any party holding the correct jobId (the decryption key) against any consumer of Mutex.runExclusive that receives a crafted callback object. The payload remains undecryptable and unexecutable without the specific jobId value.
Indicators of compromise
- Packages
- mutex-plus
- Hashes
- 6cdda0ba143b3bee5949d3d45d2145c53c02abfe0e742465cdce2c0393e94d7f
- 903169c2602ad15ba2dbc3c1e791bd26561958508d7d8a7ce35fc7d53c6212e1
Remediation
- Immediately remove or update the mutex-plus package to a patched version if available
- Audit all applications using mutex-plus for signs of unauthorized code execution or process spawning
- Review application logs for any unexpected child process creation or network activity
- If using mutex-plus, assume potential compromise and monitor for indicators of remote code execution
- Consider using an alternative, well-maintained mutex library without known malicious code
- Implement runtime monitoring to detect unexpected child process spawning from Node.js applications
Sources
- GitHub Advisory GHSA-22fx-8ffj-9hc7 · GitHub Advisory Database
Cite this entry
"Malicious code in mutex-plus (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-mutex-plus-npm-1ggu6d
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @syncraft-labs/core (npm)
The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in localize-translate (npm)
The npm package localize-translate contained malicious code in its postinstall lifecycle script that collected host identifiers and beaconed them to an attacker-controlled endpoint (gigww0v7.instances.poc.jchunt.top) without user consent. The reconnaissance callback fired automatically on every installation, collecting hostname, platform, architecture, Node version, package name, and timestamp.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in commandor-core (npm)
commandor-core@1.0.0 on npm contained malicious code in its postinstall script that downloads and executes a Windows binary (main.exe) from a typosquatted domain and beacons host information to a hardcoded IP address.
npmCompromised packageMalicious commit