MAL-2026-13959

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/prediction-trader/MAL-2026-13959.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13959
Published
2026-08-13T17:21:47Z
Modified
2026-08-13T17:30:13.480508427Z
Summary
Malicious code in prediction-trader (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (da26a91c3cc6d5bf4957fa3f713a63e579b820c40b57b24209df61b2a53d7e87)

index.js contacts a hardcoded bare-IP endpoint at 31.97.137.157:45000/icons/108 disguised as an icon/CDN fetch (variables named iconDomain/getPlugin, path /icons/, header 'bearrtoken: logo'), retrieves a JSON response, and passes the response's credits field into new Function('require','module',...,data.credits) invoked with full Node capabilities (require, module, process, Buffer, globals). Any consumer that loads the package and invokes the default export executes arbitrary attacker-controlled JavaScript delivered from that endpoint. The cover-story naming (unused setDefaultModule referencing cdnjs/cloudflare decoy domains) conflicts with the README's benign trading-library description. The declared dependencies (node-machine-id, @primno/dpapi, better-sqlite3) are consistent with wallet and browser-cookie stealer tooling and provide primitives the remotely fetched code can leverage.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017658",
            "import_time": "2026-08-13T17:24:46.235573648Z",
            "sha256": "da26a91c3cc6d5bf4957fa3f713a63e579b820c40b57b24209df61b2a53d7e87",
            "modified_time": "2026-08-13T17:21:47Z",
            "source": "amazon-inspector",
            "versions": [
                "2.3.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / prediction-trader

Package

Name
prediction-trader
View open source insights on deps.dev
Purl
pkg:npm/prediction-trader

Affected ranges

Affected versions

2.*
2.3.0

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "tlsh": "82c1716546fa31a36a63e0eef30f10027265e313375de931f48e42902fca568e5f24e8",
            "sha256": "b32a47cdb5e747380766a568efbd9e5bf0439d5e1ec09f52ad0c696895fc658b"
        }
    ],
    "package_integrity": [
        {
            "filename": "prediction-trader-2.3.0.tgz",
            "hashes": {
                "sha1": "9bc28707d5d81ca247b84f4f2f1ab1ae5f6f86e6",
                "sha512_sri": "sha512-uFt2u704W3LGGAlqklp/9DuGEgF+i7mOqiZN9QyLj9pyQw8VDnJC2pkZAZmNOVHDrMrUwjgfKZ3+CjjGK3iNQA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/prediction-trader/MAL-2026-13959.json"