MAL-2026-13421

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@trackunit/iris-app-sdk-vite/MAL-2026-13421.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13421
Published
2026-08-06T13:11:00Z
Modified
2026-08-06T14:34:49Z
Summary
Malicious code in @trackunit/iris-app-sdk-vite (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (22e0a86ea25c65d4c79c952852d254c96966dbc20a2c1017ea29cde939c35b5c)

This version of @trackunit/iris-app-sdk-vite declares cross-keychain: ^1.1.0 in its package.json dependencies. cross-keychain is a package associated with the Shai-Hulud npm worm campaign, whose install-time lifecycle hooks harvest developer credentials (npm tokens, GitHub tokens, cloud credentials) and self-propagate by republishing tainted versions under the victim's identity. Running npm install against this @trackunit/iris-app-sdk-vite version resolves and executes cross-keychain's install scripts on the installer's machine. The version string (1.2.10-alpha-d785aff3531.0) also matches the anomalous alpha-tag pattern seen across other tainted @trackunit/* releases published during the Shai-Hulud incident window, and does not correspond to a legitimate maintainer release cadence.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-016366",
            "import_time":  "2026-08-06T14:19:45.440178915Z",
            "modified_time":  "2026-08-06T13:11:00Z",
            "sha256":  "22e0a86ea25c65d4c79c952852d254c96966dbc20a2c1017ea29cde939c35b5c",
            "source":  "amazon-inspector",
            "versions":  [
                "1.2.10-alpha-d785aff3531.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @trackunit/iris-app-sdk-vite

Package

Name
@trackunit/iris-app-sdk-vite
View open source insights on deps.dev
Purl
pkg:npm/%40trackunit/iris-app-sdk-vite

Affected ranges

Affected versions

1.*
1.2.10-alpha-d785aff3531.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "package.json",
            "sha256":  "4994fd95af7eb829f5f7db4a6a54d6dfdcd005683f0ba14bce657a99fc2b72a4",
            "tlsh":  "5f118c94cb809e535ed422e96c28055254384a1bceaaf44d73b5171ccf8e68f32baa2c"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "iris-app-sdk-vite-1.2.10-alpha-d785aff3531.0.tgz",
            "hashes":  {
                "sha1":  "d55f1a178a84d84bffd719228e6a23eaa7ab2817",
                "sha512_sri":  "sha512-Ux+RggUFRQog+AEs1IiTKxYIAIJorj9uNyrvc+WwvDfhvdgrREuoy+5RUOcJ17qYIWu2nsJEVeRrU+LTpNi3XQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@trackunit/iris-app-sdk-vite/MAL-2026-13421.json"