MAL-2026-10158

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/notify-utilities/MAL-2026-10158.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10158
Published
2026-07-10T16:47:38Z
Modified
2026-07-10T17:17:00.969245857Z
Summary
Malicious code in notify-utilities (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (25536516e16cffdc7ad2891886d7dcf32ad325b9ba79c2359026809bcfbf417f)

Package published as notify-utilities masquerades as the pino logger (package.json description, keywords, and index.d.ts are copied from pino; the exported factory is named pino). When a consumer requires the package and invokes the exported factory, index.js spawns lib/vcall.js as a detached, unref'd Node child process. That child performs axios.get('https://api.jsonsilo.com/public/df71fd55-4f0c-4326-9b5b-a285e38023a5'), extracts response.data.model as a JavaScript source string, constructs a function from it via new Function.constructor('require', src), and invokes the resulting handler with the live require, giving the fetched code full module-loading access inside the installer's Node process. The remote source is a third-party JSON storage service under attacker control; the fetched content is mutable and not tied to any publisher signature or version pin. The detached+unref child pattern is used to keep the fetch-and-eval alive after the factory's synchronous return, hiding the ongoing remote execution from the calling process.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-009656",
            "sha256": "25536516e16cffdc7ad2891886d7dcf32ad325b9ba79c2359026809bcfbf417f",
            "modified_time": "2026-07-10T16:47:38Z",
            "import_time": "2026-07-10T17:10:14.864844441Z",
            "versions": [
                "1.3.5"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / notify-utilities

Package

Name
notify-utilities
View open source insights on deps.dev
Purl
pkg:npm/notify-utilities

Affected ranges

Affected versions

1.*
1.3.5

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/notify-utilities/MAL-2026-10158.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "sha256": "277f1492a353d0bea073792f7110ebdf3b266dcca9c6fe09979711e10cbc8498",
            "tlsh": "e9f0a35f30fa20594a3760f5670f81216102d53a390eedda72cc43514fd946626b7bd0",
            "path": "lib/vcall.js"
        },
        {
            "sha256": "a5746f11a2fd192d52377570a8abcf99976464fb3da13acbb494a13c4ab0ed57",
            "tlsh": "07f0ac4636f5a7a023249ec5fa0ae8372cc2c4317301ecb0d2ceb5e20743a6c86b74d8",
            "path": "index.js"
        },
        {
            "sha256": "31a7dd52427aa857e58dffe7093ebe8ee804b47eaf9464829a181a97b0037378",
            "tlsh": "cdf07224cd788e6305ec65924c2a0243a6b19c1b6818fc2933e3611c4f9d5ff15ff22e",
            "path": "package.json"
        }
    ],
    "package_integrity": [
        {
            "filename": "notify-utilities-1.3.5.tgz",
            "hashes": {
                "sha512_sri": "sha512-ksKPYFyMoYqWX28Exiw/hFuQi/kd4yceGa3KDdaE8JaFOADYVoUKEg6ZbHpgfkyAwKlN+iOfjkg4zpEP/LZxCg==",
                "sha1": "63eebe3e37d2b83201c827a830571800a4352260"
            }
        }
    ]
}