{"id":"MAL-2026-12404","summary":"Malicious code in npm-module-service (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8000a7baeda176481fd23b624485b3e419d6bed7f954900229de069c8ec4e026)\nThe default export getPlugin in index.js performs an HTTPS request to the hardcoded bare-IP endpoint https://46.183.25.232:45000/icons/107 and passes the returned data.credits field to a Function constructor invoked with require, module, process, Buffer, and Promise bound in scope. Any consumer that imports and calls the module executes attacker-supplied JavaScript with full Node.js privileges on the installer's host. The URL is assembled from separated protocol/domain/path variables, and identifiers such as iconDomain, font-awesome, cdnjs, and bearrtoken, together with a decoy setDefaultModule function, present the module as a CDN icon helper while the actual network target is an unauthenticated bare-IP host unrelated to any CDN.\n","modified":"2026-08-05T13:35:39.420408315Z","published":"2026-08-05T13:03:06Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014863","import_time":"2026-08-05T13:08:51.744845513Z","modified_time":"2026-08-05T13:03:06Z","sha256":"8000a7baeda176481fd23b624485b3e419d6bed7f954900229de069c8ec4e026","source":"amazon-inspector","versions":["3.7.2"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/npm-module-service/v/3.7.2"}],"affected":[{"package":{"name":"npm-module-service","ecosystem":"npm","purl":"pkg:npm/npm-module-service"},"versions":["3.7.2"],"database_specific":{"indicators":{"package_integrity":[{"filename":"npm-module-service-3.7.2.tgz","hashes":{"sha1":"ee17455b0a14a556ee14774e27a5f7fb83c593b2","sha512_sri":"sha512-WCMr/KOaH269lYTsOQA8+/d5jFSLrScJ39FVKZuOnunW6Zzaund7iOdrP810M1oFfdgzDUJdPhk+/H8FmMPrlg=="}}],"evidence_files":[{"path":"index.js","sha256":"647bdf81eaddc6e1296010cbbaeedf0f9c3bf72dc3e91e04944a8e374a562fe3","tlsh":"94c1616546fa31a36a67e4edf30f10027165e313365de971f48e42902fca568e5f24e8"}]},"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/npm-module-service/MAL-2026-12404.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}