MAL-2026-12423

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/react-fontawesome-icons/MAL-2026-12423.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-12423

Published

2026-08-05T12:31:32Z

Modified

2026-08-05T18:19:46.875368769Z

Summary

Malicious code in react-fontawesome-icons (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (4706d295cdd6ae07918ab25d54475d97d88e92c8ba2d3923078ba916096b4366)

The default-exported React component in react-fontawesome-icons@1.0.3 performs an unconditional axios GET to http://command.control on every render and then POSTs document.cookie (together with a static data payload) to http://commad.control/404. Any consumer application that renders this icon component transmits the user's browser session cookies to a hardcoded non-first-party destination. The source uses cover-story naming and comments (not_ma_li_ci_ous_at_all, 'nothing harmful here LOL') and a commented base64 flag-decoder around the exfiltration call, indicating deliberate misdirection rather than accident. The package is presented as a Font Awesome icon component; icon rendering does not require any outbound network traffic, and the destination hosts are not resolvable legitimate infrastructure.

Database specific

{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-05T13:08:37.825585964Z",
            "modified_time": "2026-08-05T12:31:32Z",
            "sha256": "06bc9138ae52b505e55664ed2e899a5dba05546a99c9b95622a5295ab68d4102",
            "id": "IN-MAL-2026-014690",
            "versions": [
                "1.0.6"
            ],
            "source": "amazon-inspector"
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T13:10:12Z",
            "sha256": "36a964041c29f69f015fc70f947e1172bd1e8fd92b6292d3014117d4f1c6f191",
            "id": "IN-MAL-2026-014910",
            "versions": [
                "1.0.2"
            ],
            "import_time": "2026-08-05T14:19:42.129370212Z"
        },
        {
            "import_time": "2026-08-05T14:19:41.416212277Z",
            "modified_time": "2026-08-05T13:09:07Z",
            "sha256": "aef5cf6c4b85c34ea671ef8cdab9298c27bced2231983eb09fa9c9a230a0e86c",
            "id": "IN-MAL-2026-014902",
            "versions": [
                "1.0.1"
            ],
            "source": "amazon-inspector"
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T13:09:57Z",
            "sha256": "2e0b2ce40b563a4df5cb30b6b263d7773c69c318ad994e8146219fae8c6fc6b2",
            "id": "IN-MAL-2026-014908",
            "versions": [
                "1.0.4"
            ],
            "import_time": "2026-08-05T14:19:41.937972979Z"
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T16:16:16Z",
            "sha256": "426c8f4b23bac2919ce797fd5c4ab1e68b5b231a09d8fa2a26bf65db46360509",
            "id": "IN-MAL-2026-015823",
            "versions": [
                "1.0.5"
            ],
            "import_time": "2026-08-05T17:04:49.157745806Z"
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T17:25:55Z",
            "sha256": "4706d295cdd6ae07918ab25d54475d97d88e92c8ba2d3923078ba916096b4366",
            "id": "IN-MAL-2026-015833",
            "versions": [
                "1.0.3"
            ],
            "import_time": "2026-08-05T18:07:50.656038312Z"
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com

Affected packages

npm / react-fontawesome-icons

Package

Name: react-fontawesome-icons; View open source insights on deps.dev
Purl: pkg:npm/react-fontawesome-icons

Affected ranges

Affected versions

1.*

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

Database specific

cwes

[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]

indicators

{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-3/Ursy9uQwlTsVytzxCSler3lEteM6NyMJMnisK7594c6bD/B2MALG5lGMujZiLvOIrBZyxCjdisywAPQzvLBg==",
                "sha1": "f03d23a26f6d0dc04529eaf8aac191d3ff824efd"
            },
            "filename": "react-fontawesome-icons-1.0.6.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "index.jsx",
            "sha256": "4bb77328be2325aeb8f0b0790fff2d7f45c9b1c5678e4ebb830f025bd9403861",
            "tlsh": "83f09e6f63b850b4413308d5b75dd01de20351663fc6ec04ab597f108bc1229b8672ac"
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/react-fontawesome-icons/MAL-2026-12423.json"