MAL-2026-10450

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/font-hub/MAL-2026-10450.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10450
Published
2026-07-13T14:22:43Z
Modified
2026-07-13T15:47:28Z
Summary
Malicious code in font-hub (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3df3dbd8669e4658a00a698bd8bd233d4c07de13b0f0e5533ca0d456b2ea3cf1)

index.js exports a getPlugin() function that performs an HTTPS request to https://svganchordev.net/icons/ and passes the response's credits field into new Function('require','module','exports',...,'Promise', data.credits), then invokes it with the real require, process, Buffer, and I/O globals. This executes attacker-controlled JavaScript with full Node.js privileges whenever a consumer imports the package and calls its default export. The package presents itself as a React SVG/font helper, but the README content documents an unrelated 'polymarket-clob-api' project, and the declared dependencies (@primno/dpapi, better-sqlite3, node-machine-id) are consistent with browser-credential-store access on Windows. The fetched endpoint is unrelated to any font/SVG CDN; an iconDomain map referencing cloudflare/fastly/akamai and a font-awesome path are decorative and unused by the live code path, which unconditionally targets svganchordev.net.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-010262",
            "import_time": "2026-07-13T15:30:31.48919101Z",
            "modified_time": "2026-07-13T14:22:43Z",
            "sha256": "3df3dbd8669e4658a00a698bd8bd233d4c07de13b0f0e5533ca0d456b2ea3cf1",
            "source": "amazon-inspector",
            "versions": [
                "1.5.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / font-hub

Package

Name
font-hub
View open source insights on deps.dev
Purl
pkg:npm/font-hub

Affected ranges

Affected versions

1.*
1.5.2

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "f03baeca30cfcbb5903b1d93435435be75b45695cae2510970d803a09ba7071d",
            "tlsh": "3ac1616546fa31a36a67e4edf30f10027165e3133759e971f48e42902fca568e5f24e8"
        }
    ],
    "package_integrity": [
        {
            "filename": "font-hub-1.5.2.tgz",
            "hashes": {
                "sha1": "ddf3ea97a351e29b77031ff3ced032912b912f0c",
                "sha512_sri": "sha512-ysFvjWnigWMRbWg0AU6Udq5tPd5EHumtrZsTD2lwv43JdRvzRxHVAuuYlOzfCNxw7Fjpf0dUe+2AWwyIHg7cTA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/font-hub/MAL-2026-10450.json"