MAL-2026-13421

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@trackunit/iris-app-sdk-vite/MAL-2026-13421.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13421
Published
2026-08-06T13:11:00Z
Modified
2026-08-06T14:34:49.149945499Z
Summary
Malicious code in @trackunit/iris-app-sdk-vite (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (22e0a86ea25c65d4c79c952852d254c96966dbc20a2c1017ea29cde939c35b5c)

This version of @trackunit/iris-app-sdk-vite declares cross-keychain: ^1.1.0 in its package.json dependencies. cross-keychain is a package associated with the Shai-Hulud npm worm campaign, whose install-time lifecycle hooks harvest developer credentials (npm tokens, GitHub tokens, cloud credentials) and self-propagate by republishing tainted versions under the victim's identity. Running npm install against this @trackunit/iris-app-sdk-vite version resolves and executes cross-keychain's install scripts on the installer's machine. The version string (1.2.10-alpha-d785aff3531.0) also matches the anomalous alpha-tag pattern seen across other tainted @trackunit/* releases published during the Shai-Hulud incident window, and does not correspond to a legitimate maintainer release cadence.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-06T13:11:00Z",
            "source": "amazon-inspector",
            "sha256": "22e0a86ea25c65d4c79c952852d254c96966dbc20a2c1017ea29cde939c35b5c",
            "import_time": "2026-08-06T14:19:45.440178915Z",
            "id": "IN-MAL-2026-016366",
            "versions": [
                "1.2.10-alpha-d785aff3531.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @trackunit/iris-app-sdk-vite

Package

Name
@trackunit/iris-app-sdk-vite
View open source insights on deps.dev
Purl
pkg:npm/%40trackunit/iris-app-sdk-vite

Affected ranges

Affected versions

1.*
1.2.10-alpha-d785aff3531.0

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "iris-app-sdk-vite-1.2.10-alpha-d785aff3531.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-Ux+RggUFRQog+AEs1IiTKxYIAIJorj9uNyrvc+WwvDfhvdgrREuoy+5RUOcJ17qYIWu2nsJEVeRrU+LTpNi3XQ==",
                "sha1": "d55f1a178a84d84bffd719228e6a23eaa7ab2817"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "5f118c94cb809e535ed422e96c28055254384a1bceaaf44d73b5171ccf8e68f32baa2c",
            "sha256": "4994fd95af7eb829f5f7db4a6a54d6dfdcd005683f0ba14bce657a99fc2b72a4",
            "path": "package.json"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@trackunit/iris-app-sdk-vite/MAL-2026-13421.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]