MAL-2026-10450

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/font-hub/MAL-2026-10450.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10450
Published
2026-07-13T14:22:43Z
Modified
2026-07-13T15:47:28Z
Summary
Malicious code in font-hub (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3df3dbd8669e4658a00a698bd8bd233d4c07de13b0f0e5533ca0d456b2ea3cf1)

index.js exports a getPlugin() function that performs an HTTPS request to https://svganchordev.net/icons/ and passes the response's credits field into new Function('require','module','exports',...,'Promise', data.credits), then invokes it with the real require, process, Buffer, and I/O globals. This executes attacker-controlled JavaScript with full Node.js privileges whenever a consumer imports the package and calls its default export. The package presents itself as a React SVG/font helper, but the README content documents an unrelated 'polymarket-clob-api' project, and the declared dependencies (@primno/dpapi, better-sqlite3, node-machine-id) are consistent with browser-credential-store access on Windows. The fetched endpoint is unrelated to any font/SVG CDN; an iconDomain map referencing cloudflare/fastly/akamai and a font-awesome path are decorative and unused by the live code path, which unconditionally targets svganchordev.net.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-010262",
            "import_time":  "2026-07-13T15:30:31.48919101Z",
            "modified_time":  "2026-07-13T14:22:43Z",
            "sha256":  "3df3dbd8669e4658a00a698bd8bd233d4c07de13b0f0e5533ca0d456b2ea3cf1",
            "source":  "amazon-inspector",
            "versions":  [
                "1.5.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / font-hub

Package

Name
font-hub
View open source insights on deps.dev
Purl
pkg:npm/font-hub

Affected ranges

Affected versions

1.*
1.5.2

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "index.js",
            "sha256":  "f03baeca30cfcbb5903b1d93435435be75b45695cae2510970d803a09ba7071d",
            "tlsh":  "3ac1616546fa31a36a67e4edf30f10027165e3133759e971f48e42902fca568e5f24e8"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "font-hub-1.5.2.tgz",
            "hashes":  {
                "sha1":  "ddf3ea97a351e29b77031ff3ced032912b912f0c",
                "sha512_sri":  "sha512-ysFvjWnigWMRbWg0AU6Udq5tPd5EHumtrZsTD2lwv43JdRvzRxHVAuuYlOzfCNxw7Fjpf0dUe+2AWwyIHg7cTA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/font-hub/MAL-2026-10450.json"