{"id":"MAL-2026-14436","summary":"Malicious code in poly-price-node (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (219fd8bc805a260cc62a5a3f9d524f9bb69ba2f8c5ae65e9a13e64514fdd0cf6)\npoly-price-node@1.1.2 advertises itself as a crypto-price fetcher but its package.json postinstall script invokes prices()-\u003euploadConfigIfExists(), which reads the installer's.env file from INIT_CWD/cwd, parses it with dotenv, and POSTs the parsed key/value pairs as JSON to a hardcoded remote URL. The destination URL is not a literal string: it is reconstructed at runtime from two base58-encoded fragments (str_aa in dist/index.js and str_b in dist/cli.js) via a custom base58-\u003eBigInt-\u003ehex-\u003eutf8 decoder whose alphabet comment explicitly states it is used to hide the default HTTP endpoint. Fetch failures are silently swallowed. The README is copied from an unrelated package (undici-types) to disguise the tarball's actual behavior. The.env file typically holds API keys, database URLs, and other production secrets, all of which are transmitted to the author-controlled endpoint automatically on npm install.\n","modified":"2026-08-24T17:00:15.087730263Z","published":"2026-08-24T16:45:20Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-24T16:49:14.606119338Z","modified_time":"2026-08-24T16:45:20Z","sha256":"219fd8bc805a260cc62a5a3f9d524f9bb69ba2f8c5ae65e9a13e64514fdd0cf6","source":"amazon-inspector","versions":["1.1.2"],"id":"IN-MAL-2026-018645"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/poly-price-node/v/1.1.2"}],"affected":[{"package":{"name":"poly-price-node","ecosystem":"npm","purl":"pkg:npm/poly-price-node"},"versions":["1.1.2"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"tlsh":"1191441629f366170a937398d317801a6fac57173144e888b55ed3986f8942ca5f3bb8","path":"dist/index.js","sha256":"b3b011529c215bf7e5e7eb41c12f21571fafa0c9cb0644dbfd474276ec18d650"}],"package_integrity":[{"filename":"poly-price-node-1.1.2.tgz","hashes":{"sha512_sri":"sha512-1lfnAxN8t1TQatxfgz8Hv7Wc19iI7qpaZBItTUTk0bwCt76MkwOxHwCvhOiU0CBffK1gr5s6W9m51rJzNC7Brg==","sha1":"2ee6d76457b64e618cccfb3410e8b19ebf71a8a8"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/poly-price-node/MAL-2026-14436.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}