MAL-2026-4403

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/@link-assistant/hive-mind/MAL-2026-4403.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4403
Withdrawn
2026-05-26T21:41:23Z
Published
2026-05-20T20:09:58Z
Modified
2026-08-06T23:50:30.419323372Z
Summary
Malicious code in @link-assistant/hive-mind (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (7dfeaad3a9eda8f440dabe165d4ff6ba593c9858b9752d9bded19b05b292072a)

The package fetches https://unpkg.com/use-m/use.js — an unpinned URL that resolves to the latest published version of the third-party use-m package — and passes the response body directly to eval() to bootstrap a runtime module loader. The pattern appears at the top level of src/lib.mjs (lines 34-36: globalThis.use = (await eval(await (await fetch('https://unpkg.com/use-m/use.js')).text())).use), so it fires on import of that module by any consumer or bin script. The same pattern is repeated in src/hive.mjs (lines 48-53) and across roughly thirty other files in the package. There is no version pin, no SRI hash, and no integrity verification. Any compromise of the use-m npm package, or of the unpkg response path, results in arbitrary attacker-controlled JavaScript executing in the context of every consumer that runs or imports this package — including, when the user passes --auto-cleanup, a sudo rm -rf /tmp/* /var/tmp/* shell call that broadens the blast radius. The static fetch/POST/process.env co-occurrences in config.lib.mjs, github.lib.mjs, hive.mjs, limits.lib.mjs, opencode.lib.mjs, playwright-mcp.lib.mjs, and youtrack/youtrack.lib.mjs are calls to documented vendor APIs (api.openai.com, api.anthropic.com, api.github.com, opencode.ai, youtrack.cloud) consistent with the package's stated AI-orchestration purpose and are not themselves the block basis.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "1.72.3"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-003618",
            "modified_time": "2026-05-20T21:44:41Z",
            "import_time": "2026-05-26T05:50:58.758128257Z",
            "sha256": "12e8cdb373e71695e4e6c772d1e578c5a74629620556e178d26f01f51550ea2d"
        },
        {
            "versions": [
                "1.72.5"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-003842",
            "modified_time": "2026-05-21T14:00:12Z",
            "import_time": "2026-05-26T05:51:25.678163458Z",
            "sha256": "3b232e042b208f0b97d6a628564d09393a32bcaef72e98f8e14577200cbd7acd"
        },
        {
            "versions": [
                "1.69.17"
            ],
            "source": "amazon-inspector",
            "sha256": "7dfeaad3a9eda8f440dabe165d4ff6ba593c9858b9752d9bded19b05b292072a",
            "modified_time": "2026-05-20T20:09:58Z",
            "id": "IN-MAL-2026-003608",
            "import_time": "2026-05-26T05:50:57.666860441Z"
        },
        {
            "versions": [
                "1.72.6"
            ],
            "source": "amazon-inspector",
            "sha256": "9f8fc0b69fbde13b464210c9e878b186c2ff6925216a6fbe32b696a8dc4ba6ef",
            "modified_time": "2026-05-22T18:30:32Z",
            "import_time": "2026-05-26T05:52:12.844989918Z",
            "id": "IN-MAL-2026-004238"
        },
        {
            "versions": [
                "1.72.1"
            ],
            "source": "amazon-inspector",
            "sha256": "ebdea8c9c57a1f52fa0104ecee2863d658fcdabd1d349cd98a0ac6e848a8ceb9",
            "modified_time": "2026-05-20T21:51:15Z",
            "id": "IN-MAL-2026-003619",
            "import_time": "2026-05-26T05:50:58.857959437Z"
        },
        {
            "versions": [
                "1.72.4"
            ],
            "source": "amazon-inspector",
            "import_time": "2026-05-26T05:51:22.399936578Z",
            "modified_time": "2026-05-21T12:55:38Z",
            "sha256": "3a42678dfe5e822598d5b90ab5ea844cb32d71559fdbd5e3a31417701f7adb1f",
            "id": "IN-MAL-2026-003815"
        },
        {
            "versions": [
                "2.8.9"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-016718",
            "modified_time": "2026-08-06T16:48:40Z",
            "import_time": "2026-08-06T18:09:10.577630501Z",
            "sha256": "11e4b97c6b76f963a301a8461466b51c415f6b3b9cad398545459cec0da6982f"
        },
        {
            "versions": [
                "2.7.4"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-016716",
            "modified_time": "2026-08-06T16:48:24Z",
            "import_time": "2026-08-06T18:09:10.265041577Z",
            "sha256": "b7e92ab7489635a6960406fea42699679dda9f3d69655db1d0622604c5fd96bf"
        },
        {
            "versions": [
                "2.11.12"
            ],
            "source": "amazon-inspector",
            "sha256": "f350c6a384aeb939c425b209c63310c0a5840479b4ffb44e7b0252c6e6deba30",
            "modified_time": "2026-08-06T16:48:47Z",
            "import_time": "2026-08-06T18:09:10.688137704Z",
            "id": "IN-MAL-2026-016719"
        },
        {
            "versions": [
                "2.8.7"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-016717",
            "modified_time": "2026-08-06T16:48:32Z",
            "import_time": "2026-08-06T18:09:10.415426372Z",
            "sha256": "fa906bb30e0a6098b4ed1df9baaafc1cf8033d2725c4b7af97126ec13e98d58a"
        }
    ]
}
References
Credits

Affected packages

npm / @link-assistant/hive-mind

Package

Name
@link-assistant/hive-mind
View open source insights on deps.dev
Purl
pkg:npm/%40link-assistant/hive-mind

Affected ranges

Affected versions

1.*
1.69.17
1.72.1
1.72.3
1.72.4
1.72.5
1.72.6
2.*
2.7.4
2.8.7
2.8.9
2.11.12

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "88f2d61b3861323207d71ac57f4f6806977aca68a706f4d8a85f56883f8e0249177fdb",
            "sha256": "12cb17321bb398049d9b34fca141a669b9d20ac36fe8423fb79275584493dd17",
            "path": "src/config.lib.mjs"
        }
    ],
    "package_integrity": [
        {
            "filename": "hive-mind-1.72.3.tgz",
            "hashes": {
                "sha512_sri": "sha512-3op1yZWH6gA4GXB2o1TZKsvX6xJRf+IKqNSg4YNopdHGt7SOlXAFosEj8qy1EAPwV8HRRJSnuwohxVtJwQjPBQ==",
                "sha1": "b54fc0c512619498cab297a6adf41c241a1a2e68"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/@link-assistant/hive-mind/MAL-2026-4403.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]