MAL-2026-14534

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/commonjs-code-token/MAL-2026-14534.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14534
Published
2026-08-26T14:18:32Z
Modified
2026-08-26T14:30:12.601231425Z
Summary
Malicious code in commonjs-code-token (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c6ab469a55ec3f0650bc2185b91e884304cf1e370b1e17992a328479ce4883ad)

On npm install, the package's postinstall hook runs index.js, which fetches JSON from https://access-token-delta.vercel.app and passes the returned token field directly to eval(). Whoever controls that endpoint obtains arbitrary code execution on the installing machine, and the fetched content is mutable at any time. The package advertises itself with a README for an unrelated multithreaded cache library (node-cache-multithread) while the actual package identity is commonjs-code-token, a metadata/behavior mismatch consistent with a cover story. No legitimate functionality is shipped in the package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "b5f30d280304d5e3e2f52c01495981c888bc161d54342821c90944ee908798d5",
            "id": "IN-MAL-2026-018754",
            "modified_time": "2026-08-26T14:18:42Z",
            "source": "amazon-inspector",
            "import_time": "2026-08-26T14:20:37.051613875Z",
            "versions": [
                "1.0.1"
            ]
        },
        {
            "sha256": "c6ab469a55ec3f0650bc2185b91e884304cf1e370b1e17992a328479ce4883ad",
            "id": "IN-MAL-2026-018753",
            "modified_time": "2026-08-26T14:18:32Z",
            "source": "amazon-inspector",
            "import_time": "2026-08-26T14:20:37.011021119Z",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / commonjs-code-token

Package

Name
commonjs-code-token
View open source insights on deps.dev
Purl
pkg:npm/commonjs-code-token

Affected ranges

Affected versions

1.*
1.0.0
1.0.1

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "fab0bce00f76c152ff99494b36981c87ed6617089c800a1183f85a8f2845e506",
            "path": "index.js",
            "tlsh": "46c08cba407932349a6a46cc916a203b28a4810838a0cc52830d5b885ea3d4184a3cd9"
        },
        {
            "sha256": "2c066039b2b59c6f9a613e9a79bacbb75226fc9a99a9f6070890c68ee55d8403",
            "path": "README.md",
            "tlsh": "c411d486062be2e227625beb14e58181bf3ba66d17400410e92fd49c915ddf8137f5bd"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-bkVFa2eNUs0kQFQWpTDQKamNtJhycItSbE+ijCO7OOhzboW4Er6A+rxE3Attr6MpV6CTkuWVGKyN6exQQuAapg==",
                "sha1": "cba585cbe3cafc616601306ea07f3a5d5b2f4b13"
            },
            "filename": "commonjs-code-token-1.0.1.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/commonjs-code-token/MAL-2026-14534.json"