{"id":"MAL-2026-5740","summary":"Malicious code in 2fa-exe (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (df3ad6044ca4d17d594aa3aa0d1a75d1dbf3ebf483d0dd1b04d502277674a8cc)\nPackage advertises itself as an SVG fetcher/sanitizer but ships an undocumented exported factory `getPlugin()` in index.js that performs an HTTPS GET to https://www.jsonkeeper.com/b/NGY3C (an anonymous, attacker-mutable JSON-paste service) and passes the response's `model` field directly to `eval()`. Any consumer that calls `getPlugin()` — or any tooling that mass-invokes a package's exports — executes arbitrary JavaScript fetched from a third-party paste at the moment of the call. The remote payload can change at any time without a new package release, so today's benign content provides no assurance about tomorrow's. The package name `2fa-exe` also has no relationship to the stated SVG-sanitizer purpose, consistent with bait/lure framing. There is no integrity check, no pinning, and no mention of this behavior in the README.\n","modified":"2026-06-13T20:46:41.694888417Z","published":"2026-06-13T20:15:54Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["1.0.1"],"id":"IN-MAL-2026-006375","import_time":"2026-06-13T20:33:18.791256777Z","modified_time":"2026-06-13T20:15:55Z","sha256":"acf790567380a784696688f56e72fca7d56d6992adf31b7857d34abc242d3485"},{"sha256":"ae22a4f75735f102ab93f3acb4d6cb97867a2244a2b1235bf3cb1313eaab30c6","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-006377","import_time":"2026-06-13T20:33:18.885325367Z","modified_time":"2026-06-13T20:15:58Z"},{"import_time":"2026-06-13T20:33:18.750134962Z","modified_time":"2026-06-13T20:15:54Z","sha256":"d15402567a83c6520335b1f3ce315e10089c9ad19d77d7f82a6890fe3faf99e0","source":"amazon-inspector","versions":["1.0.1"],"id":"IN-MAL-2026-006374"},{"import_time":"2026-06-13T20:33:18.853740117Z","modified_time":"2026-06-13T20:15:58Z","sha256":"df3ad6044ca4d17d594aa3aa0d1a75d1dbf3ebf483d0dd1b04d502277674a8cc","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-006376"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/2fa-exe/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/2fa-exe/v/1.0.0"}],"affected":[{"package":{"name":"2fa-exe","ecosystem":"npm","purl":"pkg:npm/2fa-exe"},"versions":["1.0.1","1.0.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/2fa-exe/MAL-2026-5740.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"hashes":{"sha1":"b2ed262e211075aecfb097ba0aa79aef406d87f0","sha512_sri":"sha512-1tw86IvmoLmY/pEtArXeTfRfpKM4aVG9ddZnEBuFiH15iIyUdzlYtXx3b44gsAsJ0t7cVZ8yicxgbCoOBRqLqw=="},"filename":"2fa-exe-1.0.1.tgz"}],"domains":["34.6.16.104.in-addr.arpa"],"evidence_files":[{"sha256":"c1acda6821d5bf402ef7ccfbdc52803dcdbe2d24ae16b4450b0b2edca58393f7","tlsh":"e57112a8999b7095d6b1e3e447135015f55ad1672208c3d4b7acc6983fb172c90f3eec","path":"index.js"},{"path":"package.json","sha256":"4c81577e01faa40a0e61efa2c66d567d8b6e8e4cb020fecf543e1d9010de371d","tlsh":"7ae07d375e20845304f48b554b36974678120f2f11308c07317b103c83f12b344dd36d"}],"ips":["104.16.8.34","104.16.5.34","10.1.0.2"]}}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}