MAL-2026-15514

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/mintel-taskbar/MAL-2026-15514.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15514
Published
2026-08-28T23:12:41Z
Modified
2026-08-28T23:31:36.956075424Z
Summary
Malicious code in mintel-taskbar (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5ebda78171ac8816c0e350f84923af0bad54c075f91cfcc1a7bcc26d36674c4f)

package.json line 11 declares the package's own name 'mintel-taskbar' as a dependency whose source is the bare HTTPS URL https://repo.securityctrl.com/mintel-taskbar, not a registry version range. On npm install, npm resolves this dependency by fetching whatever tarball that URL returns and installs it — running any lifecycle scripts inside the fetched tarball — with no version pin and no integrity check. Whoever controls repo.securityctrl.com therefore controls code executed on every installer's machine. The self-referential shape (dependency key equals the package's own name) combined with an implausibly high version (45.0.0) is consistent with a dependency-confusion lure that resolves against an internal package of the same name.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-019076",
            "source": "amazon-inspector",
            "import_time": "2026-08-28T23:14:36.537609262Z",
            "modified_time": "2026-08-28T23:12:41Z",
            "sha256": "5ebda78171ac8816c0e350f84923af0bad54c075f91cfcc1a7bcc26d36674c4f",
            "versions": [
                "45.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / mintel-taskbar

Package

Name
mintel-taskbar
View open source insights on deps.dev
Purl
pkg:npm/mintel-taskbar

Affected ranges

Affected versions

45.*
45.0.0

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "mintel-taskbar-45.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-U2nQxPePQcGcdOFMNuy7IoOsSXklYH59xruIDpeeUjfWNlLDv5KXcRelyfA01+TVTw2Os+GkxRmBwQZPESfo6g==",
                "sha1": "58f253a22db3f6cea13acc2cf72e4a5dbf309141"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "package.json",
            "tlsh": "cde026504b1003332ac910860cf940177b504f2b08443d0557cb1528c68c9b368ff26d",
            "sha256": "41674a5ecbc39cad80a66fc0eb6543bafe0a4892e397d60f007cd126dd277f1a"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/mintel-taskbar/MAL-2026-15514.json"