MAL-2026-14043

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@divineubg/divine/MAL-2026-14043.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14043
Published
2026-08-14T16:32:21Z
Modified
2026-08-14T17:00:23.299232832Z
Summary
Malicious code in @divineubg/divine (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (52dc0a48d6e7e18ff3bb09306aa6d4c17aefff323b1f86b84f19197ba4a094be)

index.js exports a listen(clientId) function that subscribes to https://ntfy.sh/dv-141u30-admin-cmd-<clientId>/sse via EventSource and, on receiving messages with action 'EVALCODE', passes the message payload to eval() and new Function() — executing attacker-supplied JavaScript in the loading context. Execution results are POSTed back to https://ntfy.sh/dv-141u30-admin-status-<clientId>. The clientId is a 7-digit value persisted in localStorage as glive_username. Any application bundling this package ships a remote command-and-control channel to end-user browsers: whoever knows or enumerates a client's topic can run arbitrary JavaScript in that browser and receive the results, with no integrity check, origin restriction, or user confirmation.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017913",
            "import_time": "2026-08-14T16:50:38.529385073Z",
            "sha256": "52dc0a48d6e7e18ff3bb09306aa6d4c17aefff323b1f86b84f19197ba4a094be",
            "modified_time": "2026-08-14T16:32:21Z",
            "source": "amazon-inspector",
            "versions": [
                "1.0.5"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @divineubg/divine

Package

Name
@divineubg/divine
View open source insights on deps.dev
Purl
pkg:npm/%40divineubg/divine

Affected ranges

Affected versions

1.*
1.0.5

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "tlsh": "cb43b31a22b71230447761efab8b554a723590033508ca587facc7842fd6e99e6f3bdd",
            "sha256": "3b64bf52d8cf9a086c409c850201ad2813ea41e1e98991b13d4a719cc7e37720"
        }
    ],
    "package_integrity": [
        {
            "filename": "divine-1.0.5.tgz",
            "hashes": {
                "sha1": "5f70aec75410a6abeef9472817b211e080a199cc",
                "sha512_sri": "sha512-GZWkbSAq2OUmiuXXRJluTcD6H+ypmYTyLFnL9xwwKMu/R2F/UWSm9ggjYxCqX8V3evDIAxq+WLZflmNERy0tQg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@divineubg/divine/MAL-2026-14043.json"