MAL-2026-14436

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/poly-price-node/MAL-2026-14436.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14436
Published
2026-08-24T16:45:20Z
Modified
2026-08-24T17:00:15.087730263Z
Summary
Malicious code in poly-price-node (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (219fd8bc805a260cc62a5a3f9d524f9bb69ba2f8c5ae65e9a13e64514fdd0cf6)

poly-price-node@1.1.2 advertises itself as a crypto-price fetcher but its package.json postinstall script invokes prices()->uploadConfigIfExists(), which reads the installer's.env file from INITCWD/cwd, parses it with dotenv, and POSTs the parsed key/value pairs as JSON to a hardcoded remote URL. The destination URL is not a literal string: it is reconstructed at runtime from two base58-encoded fragments (straa in dist/index.js and str_b in dist/cli.js) via a custom base58->BigInt->hex->utf8 decoder whose alphabet comment explicitly states it is used to hide the default HTTP endpoint. Fetch failures are silently swallowed. The README is copied from an unrelated package (undici-types) to disguise the tarball's actual behavior. The.env file typically holds API keys, database URLs, and other production secrets, all of which are transmitted to the author-controlled endpoint automatically on npm install.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-24T16:49:14.606119338Z",
            "source": "amazon-inspector",
            "modified_time": "2026-08-24T16:45:20Z",
            "sha256": "219fd8bc805a260cc62a5a3f9d524f9bb69ba2f8c5ae65e9a13e64514fdd0cf6",
            "id": "IN-MAL-2026-018645",
            "versions": [
                "1.1.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / poly-price-node

Package

Name
poly-price-node
View open source insights on deps.dev
Purl
pkg:npm/poly-price-node

Affected ranges

Affected versions

1.*
1.1.2

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "evidence_files": [
        {
            "tlsh": "1191441629f366170a937398d317801a6fac57173144e888b55ed3986f8942ca5f3bb8",
            "sha256": "b3b011529c215bf7e5e7eb41c12f21571fafa0c9cb0644dbfd474276ec18d650",
            "path": "dist/index.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "poly-price-node-1.1.2.tgz",
            "hashes": {
                "sha512_sri": "sha512-1lfnAxN8t1TQatxfgz8Hv7Wc19iI7qpaZBItTUTk0bwCt76MkwOxHwCvhOiU0CBffK1gr5s6W9m51rJzNC7Brg==",
                "sha1": "2ee6d76457b64e618cccfb3410e8b19ebf71a8a8"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/poly-price-node/MAL-2026-14436.json"