MAL-2026-15681

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@grab-food/order-sdk-web/MAL-2026-15681.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15681
Published
2026-08-24T16:24:13Z
Modified
2026-09-04T01:00:06Z
Summary
Malicious code in @grab-food/order-sdk-web (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (aa9b56bb1d69dc16b6095faea196af99809ad805b400a3c6b5499f896c8d74c2)

Package published under a scope impersonating the Grab food-ordering brand with no real functionality (index.js exports an empty object). Its sole dependency, grab-food-order-sdk-web-core@49.9.9, is pinned to a tarball URL at https://registry.grivy-packages.com/ — a lookalike domain outside the npm registry. Installing @grab-food/order-sdk-web@49.9.9 causes npm to fetch and install code from that attacker-controlled host into the installer's node_modules, bypassing npm registry inspection and running whatever lifecycle scripts and code the fetched tarball contains. This is a dependency-chain dropper: the visible package is a hollow lure, and the actual payload arrives via the non-registry dependency URL.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "RLMA-2026-05869",
            "import_time":  "2026-09-01T11:17:24.924656563Z",
            "modified_time":  "2026-08-24T16:24:13Z",
            "sha256":  "a824327f01d7927827541106fb6f567872ad3bfc3bc6cdd722a02093bea5e2f9",
            "source":  "reversing-labs",
            "versions":  [
                "49.9.9"
            ]
        },
        {
            "id":  "IN-MAL-2026-019390",
            "import_time":  "2026-09-04T00:45:55.144738436Z",
            "modified_time":  "2026-09-03T23:51:00Z",
            "sha256":  "aa9b56bb1d69dc16b6095faea196af99809ad805b400a3c6b5499f896c8d74c2",
            "source":  "amazon-inspector",
            "versions":  [
                "49.9.9"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @grab-food/order-sdk-web

Package

Name
@grab-food/order-sdk-web
View open source insights on deps.dev
Purl
pkg:npm/%40grab-food/order-sdk-web

Affected ranges

Affected versions

49.*
49.9.9

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "package.json",
            "sha256":  "f991b879a26b02975bac8c1f4ed609fcb3d7f88c09d56fd21fc354373ca0e7ea",
            "tlsh":  "e901b93cab00df135a6145b0404106866e69465f0b42bd0caf5313aa93063d6ecea92e"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@grab-food/order-sdk-web/MAL-2026-15681.json"