MAL-2026-13949

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/external-process-live-log/MAL-2026-13949.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13949
Published
2026-08-13T17:22:41Z
Modified
2026-08-13T17:30:11.192132713Z
Summary
Malicious code in external-process-live-log (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e3b21f410276a5ec436e583a1b0c08aab7f5f977f3868fd742c7a05ab0197751)

The package's default export issues an HTTPS request to the hardcoded bare-IP endpoint https://31.97.137.157:45000/icons/107 (with a 'bearrtoken: logo' header and a font-awesome-styled path used as cover) and passes the response's credits field into a new Function('require','module',...,'Promise', data.credits) constructor, executing attacker-supplied JavaScript with full Node context on the consumer's host. The package.json describes the module as a 'TypeScript SDK for the Polymarket CLOB API' and declares unused dependencies associated with credential access on Windows (@primno/dpapi, node-machine-id, better-sqlite3, socket.io-client) that index.js never references; a setDefaultModule helper fabricates a plausible CDN-style URL string that is not actually used, serving as cover for the bare-IP fetch. The package name and README frame the module as a simple process logger, which conflicts with both the declared Polymarket SDK metadata and the observed remote-execution behavior.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017664",
            "import_time": "2026-08-13T17:24:46.444310171Z",
            "sha256": "e3b21f410276a5ec436e583a1b0c08aab7f5f977f3868fd742c7a05ab0197751",
            "modified_time": "2026-08-13T17:22:41Z",
            "source": "amazon-inspector",
            "versions": [
                "13.5.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / external-process-live-log

Package

Name
external-process-live-log
View open source insights on deps.dev
Purl
pkg:npm/external-process-live-log

Affected ranges

Affected versions

13.*
13.5.2

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "tlsh": "30c1716546fa31a36a63e0eef30f10027265e313375de931f48e42902fca568e5f24e8",
            "sha256": "9496101c96f3882c29fbabca5da83d126bd495027535a2c497f88a9a22b5620c"
        },
        {
            "path": "package.json",
            "tlsh": "ddf07810ce24de6304d625866c38808ba010d90b8d10fc0c3396876c4f0e66f22fe66c",
            "sha256": "1bc1e71ad89ba14d89df8b72e7d212065a455e0124cfedd01456dd5316af18f2"
        }
    ],
    "package_integrity": [
        {
            "filename": "external-process-live-log-13.5.2.tgz",
            "hashes": {
                "sha1": "0d759ff8e829790fc146fe3e59528c09f92299a6",
                "sha512_sri": "sha512-n9MmYrLNYxcSbOEcLzR4LAXPzYxiA1h6f+urg1LdvynqYR5UCzmWYowrbgtQB9GlcFbNTyWw9TRw6UnNKnHsAg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/external-process-live-log/MAL-2026-13949.json"