{
  "schema_version": "1.6.0",
  "id": "MAL-2026-13933",
  "modified": "2026-08-12T12:00:00Z",
  "published": "2026-08-12T12:00:00Z",
  "summary": "Password-protected remote-fetch-and-execute dropper in the npm package cc-skills-helper (all 7 releases)",
  "details": "cc-skills-helper (npm, versions 1.0.0-1.0.6, published in a single 8-hour burst on 2026-04-25 by betatester44676) ships a Windows-only postinstall hook that fetches a JSON config from https://kiro-cheap.pro/api/config, downloads a password-protected ZIP whose URL and password the config returns, decrypts the ZIP to recover a .exe, and spawns it as a child process. Runtime path implements a full Windows Defender evasion stack — documented in the shipped source comments themselves. Version 1.0.6 (currently tagged latest) is obfuscator.io-hardened. Novel first-catch: no MAL-* record exists for this package upstream.",
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "cc-skills-helper"
      },
      "versions": [
        "1.0.6 (all 7 releases affected)"
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://research.codelake.dev/advisories/clr-2026-3044-cc-skills-helper"
    },
    {
      "type": "ADVISORY",
      "url": "https://osv.dev/vulnerability/MAL-2026-13933"
    }
  ],
  "credits": [
    {
      "name": "Sascha Klein, codelake Research",
      "type": "FINDER",
      "contact": [
        "https://research.codelake.dev"
      ]
    }
  ],
  "database_specific": {
    "caseId": "CLR-2026-3044",
    "kind": "malware",
    "class": "Remote fetch-and-execute dropper · Defender evasion",
    "severity": "Critical",
    "status": "Confirmed malicious",
    "iocs": {
      "ips": [],
      "hashes": [],
      "indicators": [
        "npm publisher: betatester44676 / mayukh.halder02@gmail.com",
        "Publish window: 2026-04-25 12:54-20:34 UTC (7 versions in 8h burst, then abandoned)",
        "C2 host: kiro-cheap[.]pro (defanged; currently CF-blocked as phishing)",
        "Config URL: https://kiro-cheap[.]pro/api/config (returns JSON {archiveUrl, password})",
        "Install dir: %LOCALAPPDATA%\\cc-skills-helper\\bin\\helper-<8-hex>.exe",
        "Defender manipulation: PowerShell Add-MpPreference -ExclusionPath on install dir",
        "Request User-Agent: cc-skills-helper/1.0.1",
        "Tarball SHA-256: 1.0.0=4337a6ef…5079e, 1.0.1=167a367b…faec2, 1.0.2=4adc7eee…40b0aa, 1.0.3=e563eb21…f168e, 1.0.4=580b9ae5…294c7, 1.0.5=919f86a0…02852, 1.0.6=f5c85460…4ab71"
      ]
    }
  }
}