{"items":[{"id":"NVI-00010933","kind":"supply_chain_event","title":"Malicious code in fs-commons (npm)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-72c4-xhr8-m5j8"],"plain_summary":"GitHub lists this malware advisory for fs-commons. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-5dc6e6c90df03c52c90d165539d067ec"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-5dc6e6c90df03c52c90d165539d067ec","url":"https://github.com/advisories/GHSA-72c4-xhr8-m5j8","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-72c4-xhr8-m5j8","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T23:13:53.199Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-5dc6e6c90df03c52c90d165539d067ec"],"technology":"fs-commons","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (f7e82e98343807c39ea786017de4d2a7455815424155ca2a856333d895c8a48b)\nThe package presents itself as a filesystem/data-helper library, but its exported getTransactions()/load_transaction_data() functions are a two-file dynamic-code loader. index.js hides the identifiers 'Function', 'require', 'process', 'Buffer', and 'setTimeout' behind a split-string array and obtains the Function constructor indirectly via globalThis.constructor.constructor, defeating static review. At call time it reads the sibling file models.js, which is disguised as an array of product-record objects but whose `mark` fields are base64 ciphertext. loadConfig()/processData() sort the records by id, concatenate every `mark`, apply a per-count Caesar shift, base64-decode the result, and pass the resulting source to the Function constructor with Buffer, require, and process injected, then invoke it. Any consumer that requires fs-commons and calls getTransactions() executes attacker-supplied code with full Node privileges on the host process. The obfuscation, the indirect Function-constructor acquisition, and the disguising of the payload as product metadata in a sibling file have no legiti","public_affected_ranges":["= 1.0.1"]}],"null_published_at":"2026-10-31T23:18:22.408Z","source_updated_at":"2026-09-30T00:32:26.000Z","source_disclosed_at":"2026-09-30T00:32:25.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T23:13:53.199Z"}],"next_cursor":null,"snapshot_revision":"42594"}