MAL-2026-13423

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/fetchrtds/MAL-2026-13423.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13423
Published
2026-08-06T13:56:39Z
Modified
2026-08-06T14:34:49.773096095Z
Summary
Malicious code in fetchrtds (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (74e0a6afc9e0684beee9d75d2f4966507178bed2499c8f5453629a0b827a80ef)

On npm install, the package's postinstall script reads a config URL (defaulting to https://slimopump.vercel.app/config/clob-math.json), fetches a.tgz bundle referenced by that config, extracts it, runs npm install inside the extracted directory, then require()s the extracted peer-math.js and invokes syncSession(). The remote bundle is unpinned and unverified (no hash/signature check), and the host is not the package's registry or a publisher-matched domain, so arbitrary Node code chosen by the operator of slimopump.vercel.app executes on the installer's machine at install time. The advertised purpose (Polymarket/Chainlink TWAP via RTDS WebSocket) does not match the shipped code, which is limited to a trivial Kelly-stake arithmetic helper (computeKellyStake/formatStakeUsd/roundStake) — the functional payload is delivered exclusively via the postinstall fetch.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T13:56:39Z",
            "id": "IN-MAL-2026-016547",
            "import_time": "2026-08-06T14:19:54.861291768Z",
            "sha256": "74e0a6afc9e0684beee9d75d2f4966507178bed2499c8f5453629a0b827a80ef",
            "versions": [
                "1.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / fetchrtds

Package

Name
fetchrtds
View open source insights on deps.dev
Purl
pkg:npm/fetchrtds

Affected ranges

Affected versions

1.*
1.1.0

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "fetchrtds-1.1.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-d1BNLgAp9oQtmuqPa5nHuOx8gTUZlx5j+1VMFIGl+WHvt5JqFrx9PNrW2eyJOHXNs9LQ3kZib0PcNYejicWAhg==",
                "sha1": "2befab02b56bbb8e2440ef6b1755ad646705301f"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "6ad1659915a272770bb0e7a4cb53a41eeb6394233511c364f6cdc6952ff6164c213dec",
            "sha256": "3e15f1692c4075cf29cefa94c84d564a95086ab7a6838a97ea25cd02475a282d",
            "path": "scripts/install-check.cjs"
        },
        {
            "tlsh": "c7f02837daa08d3728b8ca8a59255000f5554b2f62a44c0bb1bba15c8fb756205abb65",
            "sha256": "20bd28b0dfedcff6a8b1eaa77ecaa7928140269ddaaa3019b5c5ce7750d2dd43",
            "path": "package.json"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/fetchrtds/MAL-2026-13423.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]