MAL-2026-13961

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/velora-kit/MAL-2026-13961.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13961
Published
2026-08-13T17:21:30Z
Modified
2026-08-13T17:30:12.631958318Z
Summary
Malicious code in velora-kit (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a60310ccbaf263dc4333db7ecb716cbf5f5ae13a2cfc9d8b7416f82e4561d7bb)

velora-kit@12.0.2 exports a getPlugin() function that fetches content from a hardcoded bare-IP endpoint at https://31.97.137.157:45000/icons/116 and passes the response's data.credits field to new Function(...), which is then invoked with require, module, process, Buffer, and Promise injected — executing attacker-controlled JavaScript with full Node.js privileges in the consumer's process. Variable naming (protocol/domain/path split, bearrtoken: 'logo', token: '116') is styled to resemble a CDN icon fetcher while actually constructing a URL to a bare-IP host and evaluating the returned payload as code. The declared dependency set (@primno/dpapi for Windows DPAPI decryption, better-sqlite3/sqlite3 for browser-profile database reads, node-machine-id, socket.io-client, request, axios) provides the fetched second-stage code with capabilities aligned to credential and wallet theft from local browser profiles.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-13T17:24:46.204918114Z",
            "id": "IN-MAL-2026-017657",
            "sha256": "a60310ccbaf263dc4333db7ecb716cbf5f5ae13a2cfc9d8b7416f82e4561d7bb",
            "modified_time": "2026-08-13T17:21:37Z",
            "source": "amazon-inspector",
            "versions": [
                "12.0.2"
            ]
        },
        {
            "id": "IN-MAL-2026-017656",
            "import_time": "2026-08-13T17:24:46.173804925Z",
            "sha256": "e8e2fc9f701feadf6fb4677ac234a9750261162c33aa46153fd9acbfbfe43c3c",
            "modified_time": "2026-08-13T17:21:30Z",
            "source": "amazon-inspector",
            "versions": [
                "12.1.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / velora-kit

Package

Name
velora-kit
View open source insights on deps.dev
Purl
pkg:npm/velora-kit

Affected ranges

Affected versions

12.*
12.0.2
12.1.2

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "tlsh": "e1c1616546fa31a36a67e4eef30f100271a5e313375ce971f58e42902fca568e5f24e8",
            "sha256": "11d06250346971b7919d4f36a8138be957ef6f097a40fff636e25b7f9fbbb5ae"
        },
        {
            "path": "package.json",
            "tlsh": "93019711ce14ae7309d6625668298096a165c91f5e00fc08338e42ac0f4e92f22fe76c",
            "sha256": "1c2425344c1f02dc195cd357120e7d22f187b29d2ba542c0be460a25a3521403"
        }
    ],
    "package_integrity": [
        {
            "filename": "velora-kit-12.0.2.tgz",
            "hashes": {
                "sha1": "4dc1df1f7c87012eae9d4c204ac537e922596b76",
                "sha512_sri": "sha512-ZZwoxruCQq5KUfzUooe7mdObeHMsF5Qh2cqna5JZy1tn3NzkpxRK/Z5a7mfOajTt5f97YLWj2CI9CsXNgL+bAQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/velora-kit/MAL-2026-13961.json"