MAL-2026-10453

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/router-processor/MAL-2026-10453.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10453
Published
2026-07-13T14:22:59Z
Modified
2026-07-13T15:49:13.573329223Z
Summary
Malicious code in router-processor (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d15d816c739a85908172d716580a6e4cb0655fe7b2fe35293b218db80f9b2625)

router-processor@1.5.2 exposes a getPlugin function that assembles the URL https://svganchordev.net/icons/107 from split constants (protocol, separator, domain, path), fetches a JSON response, and passes the credits field to new Function(...) which is then invoked with a context object exposing require, process, Buffer, and other Node.js internals. This executes arbitrary attacker-controlled JavaScript with full Node privileges in the caller's process. The package declares dependencies on DPAPI bindings (Windows credential decryption), better-sqlite3, and node-machine-id, which are consistent with an infostealer loader capable of decrypting browser credential stores. The package's identity is inconsistent: package.json describes a router processor while the README advertises a Polymarket SDK, and neither matches the observed behavior of fetching remote code from an SVG-themed cover-story domain. The URL split-construction and the misleading credits/getPlugin naming are deliberate evasion of casual review.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "d15d816c739a85908172d716580a6e4cb0655fe7b2fe35293b218db80f9b2625",
            "modified_time": "2026-07-13T14:22:59Z",
            "id": "IN-MAL-2026-010263",
            "source": "amazon-inspector",
            "versions": [
                "1.5.2"
            ],
            "import_time": "2026-07-13T15:30:31.61096972Z"
        }
    ]
}
References
Credits

Affected packages

npm / router-processor

Package

Name
router-processor
View open source insights on deps.dev
Purl
pkg:npm/router-processor

Affected ranges

Affected versions

1.*
1.5.2

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-YadgQj3hsLz1q08sIeybSGkLPtHkhpwjWOol5obIhAPxVjcu3zw3dDN+uNJp6EU6VTMIYeE0dRNrOQ8supiRGQ==",
                "sha1": "f92fcbadf1ca6adc9ec80ef6a7ab3f70029798f8"
            },
            "filename": "router-processor-1.5.2.tgz"
        }
    ],
    "evidence_files": [
        {
            "sha256": "f03baeca30cfcbb5903b1d93435435be75b45695cae2510970d803a09ba7071d",
            "tlsh": "3ac1616546fa31a36a67e4edf30f10027165e3133759e971f48e42902fca568e5f24e8",
            "path": "index.js"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/router-processor/MAL-2026-10453.json"