@thiennq/docs-viewer@1.6.3
Malicious code in @thiennq/docs-viewer (npm)
T1059.007 · JavaScriptT1027 · Obfuscated Files or InformationT1105 · Ingress Tool Transfer
Analysis
The package's preinstall hook (node setup.mjs) downloads the bun runtime and executes a bundled 727KB file (math_init.js) at install time. That file is heavily obfuscated with a custom decoder and rotated string array, and its decoded content is binary/compressed, so its behaviour is hidden from inspection. The payload is unrelated to the package's declared function (a static docs-viewer HTTP server that otherwise uses only built-in Node modules). Installing this package runs an opaque, obfuscated executable payload during install.
- analyzed by
- Leitwacht
- first seen
- Aug 4, 2026, 12:58 PM
- analyzed
- Aug 4, 2026, 01:32 PM
- weekly installs
- 228
Related advisories
- @onereach/idw-contracts@0.1.4
- @onereach/time-interpreter@1.0.32
- verdaccio-tarball-local-storage@38.1.12
- @servicetitan/marketing-direct-mail-components@20.1.5
- folder-lint@1.0.17
- editable-contracts@0.0.23
- @servicetitan/anvil2-ext-charts@0.2.8
- @servicetitan/titan-chatbot-ui-cypress@9.0.5
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.