{"id":"MAL-2026-4562","summary":"Malicious code in figma-d2c-utils (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b65db74a06749bbb141552f97e91b15d5bdd91b57a0136dfc8bfb4034b659c8f)\nThe package ships dist/report.js, a one-line module that issues an HTTPS POST to https://www.baidu.com carrying values read from process.env. The destination has no relationship to the package's stated purpose (Figma design-to-code utilities) and is not a documented telemetry or API endpoint for any Figma workflow. The companion file dist/export-figma-images.cjs additionally constructs https.request calls referencing process.env values; while one such call legitimately targets api.figma.com, the report.js beacon to baidu.com is structurally an exfiltration channel — a hardcoded third-party host receiving environment data on every invocation. Installers who require this package, or run any code path that loads dist/report.js, will leak process.env contents (which on developer machines and CI commonly includes FIGMA_TOKEN, GITHUB_TOKEN, NPM_TOKEN, AWS credentials, and other secrets) to an attacker-chosen destination.\n","modified":"2026-05-27T00:32:11.609867319Z","published":"2026-05-20T03:09:33Z","withdrawn":"2026-05-26T18:41:02Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-003444","import_time":"2026-05-26T05:50:39.325518811Z","modified_time":"2026-05-20T03:09:33Z","sha256":"b65db74a06749bbb141552f97e91b15d5bdd91b57a0136dfc8bfb4034b659c8f","source":"amazon-inspector","versions":["0.6.0"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/figma-d2c-utils/v/0.6.0"}],"affected":[{"package":{"name":"figma-d2c-utils","ecosystem":"npm","purl":"pkg:npm/figma-d2c-utils"},"versions":["0.6.0"],"database_specific":{"indicators":{"evidence_files":[{"sha256":"2ca868d20c7e3ad134e3d9db29287e1f2331a63c0c6fc6d05bd0ee687b429d82","tlsh":"6222a58e46f722158273a1ad1a1b941a7d9aa413340ece48f6dc92943fc2475d1f7bfc","path":"dist/export-figma-images.cjs"},{"path":"dist/report.js","sha256":"a8792ec9780290e34d74cbd6b0029c0dcbb2391595b8e2012a8242d163470df8","tlsh":"d12163e2a7107b74cfed8b309406030c33b3b299ce90ce78b8ee415a81844232337b48"}],"package_integrity":[{"filename":"figma-d2c-utils-0.6.0.tgz","hashes":{"sha1":"1d138e536e41e030d3c9d940de34e891b0a7355e","sha512_sri":"sha512-ZdbuwlFXgNZULomgwoQdx7HkJc0r7zIaccLLp2q1qh0KeYPXOoJxWouqgvdLb1jbW9Ws50yy/cLCRoglVKlI+g=="}}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/figma-d2c-utils/MAL-2026-4562.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"}]}