MAL-2026-11136

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/fluid-type-ui/MAL-2026-11136.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-11136
Published
2026-07-28T13:28:21Z
Modified
2026-07-28T14:36:59.693120300Z
Summary
Malicious code in fluid-type-ui (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (de176a872add830e311ef01f6432b609d41e31cbf2ec6bf2dbc473dcff5c2216)

src/index.js in fluid-type-ui@2.0.8 contains a hidden code block, pushed off-screen by a long run of tab characters, that runs when the module is loaded via require. The block queries Ethereum JSON-RPC endpoints (1rpc.io/eth, eth.drpc.org, eth.blockscout.com) for a transaction from the hardcoded address 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a, extracts two IPv4 addresses embedded in the transaction's to field, HTTP-GETs /0x/ls from the first, XOR-decrypts the response with a 16-byte key, and passes the decoded bytes to eval with a prelude that binds global.r=require and global.m=module. The result is arbitrary attacker-controlled code execution on every require of the package, with the command-and-control destination mutable via new on-chain transactions, making takedown resistant. The package is presented as a Tailwind plugin; the EtherHiding-style loader has no relationship to that stated purpose.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "2.0.8"
            ],
            "import_time": "2026-07-28T14:19:56.295195317Z",
            "sha256": "de176a872add830e311ef01f6432b609d41e31cbf2ec6bf2dbc473dcff5c2216",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-010862",
            "modified_time": "2026-07-28T13:28:21Z"
        }
    ]
}
References
Credits

Affected packages

npm / fluid-type-ui

Package

Name
fluid-type-ui
View open source insights on deps.dev
Purl
pkg:npm/fluid-type-ui

Affected ranges

Affected versions

2.*
2.0.8

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "f826e01336b1f2121fcd5a40c0d888780a250b5b0884bd4f2c57ebdf7de81d51",
            "tlsh": "6951668153f9b636818be19de12e0842e0f2dbba250b4c18ba1d82935f561b4a5b3624",
            "path": "src/index.js"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "d812607d81e3485ca668f68600eab7c9e63f9002",
                "sha512_sri": "sha512-ZS2ofDGyswrRlkj/LRwr9CcN9NDqgQExikjFWNK9kDNfQ50VOjOl3h5eqg0/cGTR0TT9mc5uziDYMu3+SSyC+A=="
            },
            "filename": "fluid-type-ui-2.0.8.tgz"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/fluid-type-ui/MAL-2026-11136.json"