MAL-2026-13401

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/helmet-pro/MAL-2026-13401.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13401
Published
2026-08-06T12:30:20Z
Modified
2026-08-06T13:34:42.557766235Z
Summary
Malicious code in helmet-pro (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ea17cadddf76a704e98b6c98881f654b13eb16a54d51af5a6b547e36a58d3402)

helmet-pro@10.0.4 is a typosquat of the popular helmet HTTP-header middleware. Its package.json postinstall hook runs lib/utils/index.js, which spawns lib/utils/smtp-connection/index.js as a detached child with all stdio silenced. That file is string-array/hex-name obfuscated and, when decoded, performs an axios.get against https://api.jsonbin.io/v3/b/6a719632da38895dfeb7128d and passes the returned record.message to new Function('require',...)(require). The result is arbitrary remote code execution on the installer's machine at npm install time, with require available to the fetched payload. The jsonbin.io record is attacker-mutable, so the executed payload can change at any time without republishing the package. The package also masquerades in metadata/comments as a nodemailer-adjacent SMTP module to disguise the dropper.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "10.0.4"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-016093",
            "modified_time": "2026-08-06T12:30:20Z",
            "sha256": "ea17cadddf76a704e98b6c98881f654b13eb16a54d51af5a6b547e36a58d3402",
            "import_time": "2026-08-06T13:08:48.598419391Z"
        }
    ]
}
References
Credits

Affected packages

npm / helmet-pro

Package

Name
helmet-pro
View open source insights on deps.dev
Purl
pkg:npm/helmet-pro

Affected ranges

Affected versions

10.*
10.0.4

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/helmet-pro/MAL-2026-13401.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha1": "3e65b256cfdf774bf631da6faa93ee247126107f",
                "sha512_sri": "sha512-zNEwySdN6ZKHk8ipEFaXWUJZA8mq+zetK6yW/1Z45MZ/Yp87i51kBdZV79d7FmsKQCQhg2XHxrVUFYnz9RjGQQ=="
            },
            "filename": "helmet-pro-10.0.4.tgz"
        }
    ],
    "evidence_files": [
        {
            "tlsh": "0b217819bf8427a1278759fb6a679874c223ec92f89c5d099076f0a43cd0924dbc3634",
            "sha256": "082583b62d90da834dc8e262f6999bcd2a1194e3ef3fefca8d70f6c1ebc4fa79",
            "path": "lib/utils/smtp-connection/index.js"
        },
        {
            "tlsh": "dae0686a23533738a034cbc1da30ce3b258b8020b365a0e0f00c406a2bc72c406ea8da",
            "sha256": "9fb27c30f484650bb4a39f65a03fbccdc0b9b5f1cb84700ca73ee8893c66e06e",
            "path": "lib/utils/index.js"
        }
    ]
}