MAL-2026-4562

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/figma-d2c-utils/MAL-2026-4562.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4562
Withdrawn
2026-05-26T18:41:02Z
Published
2026-05-20T03:09:33Z
Modified
2026-05-27T00:32:11Z
Summary
Malicious code in figma-d2c-utils (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b65db74a06749bbb141552f97e91b15d5bdd91b57a0136dfc8bfb4034b659c8f)

The package ships dist/report.js, a one-line module that issues an HTTPS POST to https://www.baidu.com carrying values read from process.env. The destination has no relationship to the package's stated purpose (Figma design-to-code utilities) and is not a documented telemetry or API endpoint for any Figma workflow. The companion file dist/export-figma-images.cjs additionally constructs https.request calls referencing process.env values; while one such call legitimately targets api.figma.com, the report.js beacon to baidu.com is structurally an exfiltration channel — a hardcoded third-party host receiving environment data on every invocation. Installers who require this package, or run any code path that loads dist/report.js, will leak process.env contents (which on developer machines and CI commonly includes FIGMA_TOKEN, GITHUB_TOKEN, NPM_TOKEN, AWS credentials, and other secrets) to an attacker-chosen destination.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-003444",
            "import_time": "2026-05-26T05:50:39.325518811Z",
            "modified_time": "2026-05-20T03:09:33Z",
            "sha256": "b65db74a06749bbb141552f97e91b15d5bdd91b57a0136dfc8bfb4034b659c8f",
            "source": "amazon-inspector",
            "versions": [
                "0.6.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / figma-d2c-utils

Package

Name
figma-d2c-utils
View open source insights on deps.dev
Purl
pkg:npm/figma-d2c-utils

Affected ranges

Affected versions

0.*
0.6.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "dist/export-figma-images.cjs",
            "sha256": "2ca868d20c7e3ad134e3d9db29287e1f2331a63c0c6fc6d05bd0ee687b429d82",
            "tlsh": "6222a58e46f722158273a1ad1a1b941a7d9aa413340ece48f6dc92943fc2475d1f7bfc"
        },
        {
            "path": "dist/report.js",
            "sha256": "a8792ec9780290e34d74cbd6b0029c0dcbb2391595b8e2012a8242d163470df8",
            "tlsh": "d12163e2a7107b74cfed8b309406030c33b3b299ce90ce78b8ee415a81844232337b48"
        }
    ],
    "package_integrity": [
        {
            "filename": "figma-d2c-utils-0.6.0.tgz",
            "hashes": {
                "sha1": "1d138e536e41e030d3c9d940de34e891b0a7355e",
                "sha512_sri": "sha512-ZdbuwlFXgNZULomgwoQdx7HkJc0r7zIaccLLp2q1qh0KeYPXOoJxWouqgvdLb1jbW9Ws50yy/cLCRoglVKlI+g=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/figma-d2c-utils/MAL-2026-4562.json"