MAL-2026-12798

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/npm-groat/MAL-2026-12798.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12798
Published
2026-08-05T13:17:59Z
Modified
2026-08-05T14:37:17.147092258Z
Summary
Malicious code in npm-groat (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (eda7da760041a49d296b9a6e8cfa90ec4b7e5daecebbf50c88d41f7fd559a1b1)

npm-groat@1.1.1 declares a postinstall script that executes dist/config.js on npm install. That script performs an outbound fetch to https://my-api.trade-api.workers.dev?id=0 and then evaluates the response by calling globalThisdata.success — treating attacker-controlled JSON fields as the name of a global function (e.g. eval or Function) and its argument. This gives the remote endpoint arbitrary code execution on the installer's host during package installation. The same file also contains a bare globalThistag referencing undeclared identifiers, consistent with a dead-drop stager rather than legitimate configuration. The package's advertised purpose has no need to contact a remote server at install time.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T13:17:59Z",
            "sha256": "2188ca632e649f444536268f4d76e0d258b0a0b39436573b7ac4f07df440ffa3",
            "id": "IN-MAL-2026-014963",
            "versions": [
                "1.1.2"
            ],
            "import_time": "2026-08-05T14:19:47.267646994Z"
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T13:18:09Z",
            "sha256": "eda7da760041a49d296b9a6e8cfa90ec4b7e5daecebbf50c88d41f7fd559a1b1",
            "id": "IN-MAL-2026-014964",
            "versions": [
                "1.1.1"
            ],
            "import_time": "2026-08-05T14:19:47.356126379Z"
        }
    ]
}
References
Credits

Affected packages

npm / npm-groat

Package

Name
npm-groat
View open source insights on deps.dev
Purl
pkg:npm/npm-groat

Affected ranges

Affected versions

1.*
1.1.1
1.1.2

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-kmil046Xri8zqkkAcROLhI28EdPSJ04sH34oHH9UFU5uchDxV9V6kcmud+A1M0yQ2dobuq5/9LQPM3yzMVqVsA==",
                "sha1": "337e650526460050ba32b2f77e5f0d8b7f37246b"
            },
            "filename": "npm-groat-1.1.2.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "dist/config.js",
            "sha256": "ef91514dc36b5af51d5e1564233e565861e659e309f0848d8cefedf163d04621",
            "tlsh": "43d0977bc28da028681070ddd0090230b083e5228b2e840bea1dead19cd5a20ea00130"
        },
        {
            "path": "package.json",
            "sha256": "40865fd9402acde866e069ffb4685df6dcb612f47c9690364d1d93b24a44d75a",
            "tlsh": "3501263bc9948e3315f4dba26d260742fa210b1f11a44c0bb0be501c0fb219704bbbb9"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/npm-groat/MAL-2026-12798.json"