MAL-2026-15555

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/js-array-tokens/MAL-2026-15555.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15555
Published
2026-08-29T02:13:19Z
Modified
2026-08-29T02:30:11.878277184Z
Summary
Malicious code in js-array-tokens (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3d54ea75aacb3eed3e1f1739093eb9b0092203fafca42d590bce038530056023)

On module load, index.js reconstructs a URL from a char-code array that decodes to https://access-token-delta.vercel.app/, fetches a JSON response, and passes the response's token field directly to eval(). Any code the remote host returns executes in the Node.js process that requires this package. The destination is hidden as a numeric array reconstructed via String.fromCharCode, concealing the endpoint from plain-string inspection. The combination of import-time fetch-and-eval against a char-code-obfuscated remote endpoint is a remote-loader pattern with no legitimate use.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-019135",
            "modified_time": "2026-08-29T02:13:19Z",
            "import_time": "2026-08-29T02:22:20.534220285Z",
            "source": "amazon-inspector",
            "sha256": "3d54ea75aacb3eed3e1f1739093eb9b0092203fafca42d590bce038530056023",
            "versions": [
                "1.0.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / js-array-tokens

Package

Name
js-array-tokens
View open source insights on deps.dev
Purl
pkg:npm/js-array-tokens

Affected ranges

Affected versions

1.*
1.0.2

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "js-array-tokens-1.0.2.tgz",
            "hashes": {
                "sha512_sri": "sha512-IknDspur8jm6ero6XMpmgtM9/nEz+XBzFWmMj2mAySncT/LXB2eyElmXO7/wTgqQJs4f6N2HRfRkvAmGereuHg==",
                "sha1": "17505c2800ad8c5a333b35d9abe509f4c02e9f92"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "index.js",
            "tlsh": "64f05c9114bc4935023fe46a060f1c16950ce3131d3de4c3b3cc0f442f194697d756c8",
            "sha256": "9ba5c69b6016243e1887e60c4acb1886d80ef98d4b471c54343271851efb976b"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/js-array-tokens/MAL-2026-15555.json"