MAL-2026-10471

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/loading-sessions/MAL-2026-10471.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10471
Aliases
  • GHSA-qrjp-fmwp-2rjq
Published
2026-07-13T18:54:09Z
Modified
2026-09-01T11:31:37Z
Summary
Malicious code in loading-sessions (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ed919f49d3732fb5d4bd8b177022ed58d9c08b2cded5a6141e2da07c66966a94)

Package name impersonates the pino logger (exports module.exports.pino, ships pino-style files lib/proto.js, lib/levels.js, lib/redaction.js, lib/multistream.js, lib/transport.js, copies pino keywords ['fast','logger','stream','json']). When the exported middleware is invoked, index.js spawns a detached node lib/caller.js child. lib/caller.js base64-decodes a hardcoded URL (https://api.jsonstorage.net/v1/json/2ef8c758-a96f-459e-b036-b3b90379a165/a179ea35-b962-4722-b3f1-e28316d1a44a) disguised as a DEV_API_KEY env-var fake, GETs the JSON document, and passes the response's data.cookie string to new Function.constructor('require', s) and invokes it with require. The fetched content is attacker-controlled and mutable, runs with full Node require access, retries up to 5 times, and is detached so failures are silent. Headers (x-secret-key) are also base64-decoded from masquerading env-var names. This is a classic remote-code dropper hidden behind a typosquat lure.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-010290",
            "import_time":  "2026-07-13T19:00:27.307313594Z",
            "modified_time":  "2026-07-13T18:54:09Z",
            "sha256":  "ed919f49d3732fb5d4bd8b177022ed58d9c08b2cded5a6141e2da07c66966a94",
            "source":  "amazon-inspector",
            "versions":  [
                "6.13.2"
            ]
        },
        {
            "id":  "RLMA-2026-05569",
            "import_time":  "2026-07-20T13:14:48.880010295Z",
            "modified_time":  "2026-07-20T10:48:54Z",
            "sha256":  "2907d99272726cc1d10648311e8b9ae77b53164a89ab868a510dc1d6f1c4c11f",
            "source":  "reversing-labs",
            "versions":  [
                "6.13.2"
            ]
        },
        {
            "id":  "RLUA-2026-06309",
            "import_time":  "2026-09-01T11:18:11.269094431Z",
            "modified_time":  "2026-08-24T16:57:57Z",
            "sha256":  "a1d8bcdcd684fcc154d56384b6a7779d786910d7133cf66534d0e270b090bb0d",
            "source":  "reversing-labs"
        }
    ]
}
References
Credits

Affected packages

npm / loading-sessions

Package

Name
loading-sessions
View open source insights on deps.dev
Purl
pkg:npm/loading-sessions

Affected ranges

Affected versions

6.*
6.13.2

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "lib/caller.js",
            "sha256":  "37e9dde0f35864e2ea8dcd4c8b5324ef50e3798195d04c30ba6938352af702db",
            "tlsh":  "1b01af9934fe541c015112e9171fa1326050e4673d86e6c83b4c87129fa667e6e93adf"
        },
        {
            "path":  "index.js",
            "sha256":  "2956b023858d706a5e241cd28b845088e5f414c5f70bd5d8cb73cb427d081065",
            "tlsh":  "5d213c81b9f11188065cd9c8b569e53a38e3c4377207b9b0e9ec87862bcf2080272ad7"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "loading-sessions-6.13.2.tgz",
            "hashes":  {
                "sha1":  "277bc3b8cbccebcc3855a115cdac0aca086d5592",
                "sha512_sri":  "sha512-3wpv2/9u/m09IGUZbUi4yockVcbtTE/djxJux3Qf4yLJmUXO1q8TClJTz2VtDKzrF1QHVeQqgM/UrASgFdYLNw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/loading-sessions/MAL-2026-10471.json"