This file/script is supposed to scan for outdated Node modules and prompt the developer to update them, however I believe it is malware.

The instructions were to download the file, set the executable flag (chmod +x) and run it from the directory of the project (or with the -g flag to scan global Node modules).

Here is the contents of the file:

openssl enc -base64 -d <<< b3BlbnNzbCBlbmMgLWJhc2U2NCAtZDw8PGJtOWtaU0F0TFdWMllXd2dJbkpsY1hWcGNtVW9KMk5vYVd4a1gzQnliMk5sYzNNbktTNWxlR1ZqUm1sc1pWTjVibU1vSjNCb2NDY3NXeWN0Y2ljc1hHQnplWE4wWlcwb1hDSndlWFJvYjI0Z0xXTWdYRnhjWEZ3aWFXMXdiM0owSUhOMVluQnliMk5sYzNNN2MzVmljSEp2WTJWemN5NWpZV3hzS0ZzbmNuVmllU2NzSnkxbEp5d25aWGhsWXlCY1hGd25KQ2gzYUdsamFDQm5ieWtnY25WdUlHTm1PRE5sTVRNMU4yVmxabUk0WW1SbU1UVTBNamcxTUdRMk5tUTRNREEzWkRZeU1HVTBNRFV3WWpVM01UVmtZemd6WmpSaE9USXhaRE0yWTJVNVkyVTBOMlF3WkRFell6VmtPRFZtTW1Jd1ptWTRNekU0WkRJNE56ZGxaV015WmpZellqa3pNV0prTkRjME1UZGhPREZoTlRNNE16STNZV1k1TWpka1lUTmxMbWR2WEZ4Y0p5ZGRLVnhjWEZ4Y0lsd2lLVHRjWUYwc2UzTjBaR2x2T2lkcGJtaGxjbWwwSjMwcE95ST18c2g=|sh

After I investigated a bit, it appears that the actual commands were double encoded. This is what the obfuscated code looks like in decoded form:

node --eval "require('child_process').execFileSync('php',['-r',\`system(\"python -c \\\\\"import subprocess;subprocess.call(['ruby','-e','exec \\\'$(which go) run cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e.go\\\''])\\\\\"\");\`],{stdio:'inherit'});"

If I understand correctly, the script executes a Node script to synchronously spawn 1 PHP process that spawns 1 Python process which in turn spawns 1 Ruby process to spawn a Go process to run a file (which doesn't exist).

It appears that the file name is a SHA-512 hash (there are quite a few results on Google for it, though I'm not sure what the hash is supposed to refer to).

  1. What's the purpose of writing this script to run a file that most likely doesn't exist in anyone's projects?
  2. Is this an example of a fork bomb? It only appears to create 5 processes in total (not exponential), unless I misinterpreted something.
  3. What's the purpose of spawning the processes through the different interpreters (Node, PHP, Python, etc.)? Wouldn't it be easier to encode the command go run <filename>.go? And also wouldn't it be more likely to work (as the victim would only require go in their PATH instead of needing all of the tools)?
  • 1
    "This file/script is supposed to ...." - can you give a source for this claim? Where do you got this script from. This does look more like a joke to me. – Steffen Ullrich Jan 10 '16 at 11:52

Any serious virus probably wouldn't want to bet on the victim having all those languages installed. The script doesn't appear to be malicious at all, I ran it in a VM and it went about as expected. Its almost certainly some kind of joke.

The filename is the sha512 hash of an empty string (checked here).

  • So what did it do? Try to run a non-existent Go file? – rink.attendant.6 Jan 11 '16 at 5:48
  • @rink.attendant.6 yep – Ammar Bandukwala Jan 11 '16 at 18:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.