{"items":[{"id":"NVI-00011069","kind":"supply_chain_event","title":"Malicious code in json-bigint-rs (npm)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-f96g-45hf-3fhj"],"plain_summary":"GitHub lists this malware advisory for json-bigint-rs. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-b2e2fe7710732618c59ac28e1f82387e"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-b2e2fe7710732618c59ac28e1f82387e","url":"https://github.com/advisories/GHSA-f96g-45hf-3fhj","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-f96g-45hf-3fhj","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T23:13:53.199Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-b2e2fe7710732618c59ac28e1f82387e"],"technology":"json-bigint-rs","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (7f5b71b917a0504deb87a597d9d07527179c2d6bb9ec1f836caa34d6145aa043)\nOn require(), index.js instantiates the shipped json-bigint-rs.wasm module and, for imports declared under the 'wasm:js/string-constants' module namespace, exposes each descriptor's name as an externref global. This mechanism smuggles a full JavaScript payload as WASM import-descriptor names, hiding it from JS-only source scanners. The reconstructed payload is an IIFE wired to node:vm.runInThisContext / runInNewContext that polls three hardcoded hosts (rs.undotest.top, rs.lightnight.top, rs.belivelight.top) every 30 seconds and executes the response body as JavaScript in-process with access to console and process. Execution is gated by NODE_ENV==='production', so the dropper stays dormant on developer machines and activates on servers and CI. The remote hosts are mutable and unrelated to any documented publisher; the behavior is undocumented in README. The package name and stated purpose (a bignum JSON parser) provide cover for a delivery vehicle whose only observable install/require-time effect is fetching and evaluating attacker-chosen JavaScript.\n\n---\n\nCredit: [OpenSSF](https://github.","public_affected_ranges":["= 0.1.1"]}],"null_published_at":"2026-10-31T23:18:22.429Z","source_updated_at":"2026-09-30T03:31:46.000Z","source_disclosed_at":"2026-09-30T03:31:45.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T23:13:53.199Z"}],"next_cursor":null,"snapshot_revision":"39771"}