MAL-2026-15621

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/gas-monitor/MAL-2026-15621.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15621
Published
2026-08-31T16:41:24Z
Modified
2026-08-31T17:30:12.641407453Z
Summary
Malicious code in gas-monitor (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b218a26d55f47d2b60f56267a03c299dbed364fe6393cd2f1230f364020bc79e)

gas-monitor@1.1.0 impersonates eth-gas-reporter (author field set to cgewecke, source tree mirrored, README pivoted to generic 'multi-chain gas analytics' marketing). index.js exports log as a mocha reporter; inside, a var opt = 1; if (!opt) {...real reporter... } else { gestest(); } guard makes the legitimate reporter branch unreachable and unconditionally invokes utils.connectNet(...), which detached-spawns node lib/syncResolve.js. lib/syncResolve.js fetches a JavaScript string from https://api.jsonbin.io/v3/b/6a93356ada38895dfe21087c and executes it via new Function.constructor('require', result)(require), giving the operator of the jsonbin record arbitrary Node code execution with the caller's require handle on any host that loads the reporter. The jsonbin record is author-mutable, so the executed payload can change without republishing the package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-31T17:16:12.437653749Z",
            "source": "amazon-inspector",
            "versions": [
                "1.1.0"
            ],
            "id": "IN-MAL-2026-019154",
            "modified_time": "2026-08-31T16:41:24Z",
            "sha256": "b218a26d55f47d2b60f56267a03c299dbed364fe6393cd2f1230f364020bc79e"
        }
    ]
}
References
Credits

Affected packages

npm / gas-monitor

Package

Name
gas-monitor
View open source insights on deps.dev
Purl
pkg:npm/gas-monitor

Affected ranges

Affected versions

1.*
1.1.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/gas-monitor/MAL-2026-15621.json"
indicators 
{
    "evidence_files": [
        {
            "path": "lib/syncResolve.js",
            "tlsh": "22019c9e3469f0180ef012e5db176022e6025f263107b1d5729d97521f7ada85602eec",
            "sha256": "0b804d0c5fe35a50fdc94dda1e5d7d60f8eb8dbb0ad7ce0e7ec728a2812f3aa0"
        },
        {
            "path": "index.js",
            "tlsh": "b3f1fe322eb7153745e3faac9bcba061d12696372201cfad7a8c93104f5447894efbe4",
            "sha256": "db6f048ab50bdad5c12883185a63f731a1ff1f9d98055ea63e34e9d28137415f"
        }
    ],
    "package_integrity": [
        {
            "filename": "gas-monitor-1.1.0.tgz",
            "hashes": {
                "sha1": "4851b05f46041a661ef331baf1830cbdb9548d50",
                "sha512_sri": "sha512-EktXf4HZva+wBeu4aWLvkByZrb0DJWJ3VShsZG23sI0TqPZkbIFauX2pgTWp0gmXggI3qcw4jZzkRxHKMVhFbw=="
            }
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]