MAL-2026-6592

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/maplibre-gl-vue3/MAL-2026-6592.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6592
Published
2026-06-29T09:11:39Z
Modified
2026-07-09T22:17:02.570651254Z
Summary
Malicious code in maplibre-gl-vue3 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a46347c152553bd008255683dd927e5f25233224d3c6f1df6ae87533350b5815)

The package advertises itself as MapLibre GL bindings for Vue 3 and re-exports the upstream maplibre-gl API, but on import it unconditionally injects a <script> tag into document.head pointing at http://121.199.166.250:19527/myApi/pipesnetwork.js. src/index.ts calls loadGuardScript() at module top level; src/license.ts defines GUARDSCRIPTURL and appends the script element to document.head. Any Vue 3 application that imports this package will fetch and execute attacker-controlled JavaScript from a hardcoded bare-IP, plaintext-HTTP endpoint in the consumer's browser context — giving the operator of that endpoint full access to cookies, localStorage, session tokens, and user input in the host application. The endpoint is unpinned (no SRI, no version), served over HTTP (mutable in transit), and unrelated to mapping functionality. A source comment ('改这里：发布给第三方前换成你托管的 guard 脚本地址' — 'change this before releasing to third parties: replace with your hosted guard script address') indicates the loader is intended to deliver third-party-controlled code to downstream consumers. The package name also shadows the maplibre-gl ecosystem (legitimate Vue bindings are published as vue-maplibre-gl), increasing the chance of accidental installation.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "1.0.0"
            ],
            "import_time": "2026-06-29T11:17:08.86340683Z",
            "sha256": "a46347c152553bd008255683dd927e5f25233224d3c6f1df6ae87533350b5815",
            "ranges": [
                {
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ],
                    "type": "SEMVER"
                }
            ],
            "id": "IN-MAL-2026-007784",
            "modified_time": "2026-06-29T09:11:39Z",
            "source": "amazon-inspector"
        },
        {
            "sha256": "6e3b161473fd04c687b0de94bcbeca68901125281f8166e295c308da167d38e1",
            "import_time": "2026-07-08T23:27:58.181459554Z",
            "versions": [
                "5.24.2"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-008996",
            "modified_time": "2026-07-08T23:03:35Z"
        },
        {
            "sha256": "e0554b41a629091df72afc1730687b9af748668acfdd00ff539101203c49b31d",
            "import_time": "2026-07-08T23:27:56.661258742Z",
            "versions": [
                "5.24.1"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-008972",
            "modified_time": "2026-07-08T23:00:11Z"
        },
        {
            "sha256": "c97e73217b484cb7a1ab73c2633f695b16be42e84d7be80bd5c72ecb38982031",
            "import_time": "2026-07-09T22:02:29.367679459Z",
            "versions": [
                "5.24.3"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-009418",
            "modified_time": "2026-07-09T21:53:05Z"
        }
    ]
}
References
Credits

Affected packages

npm / maplibre-gl-vue3

Package

Name
maplibre-gl-vue3
View open source insights on deps.dev
Purl
pkg:npm/maplibre-gl-vue3

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.0.0
5.*
5.24.1
5.24.2
5.24.3

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "sha256": "d7174b570716bf6f79dce63b66c4cf0f450cd4ab840431db127b411771eb7d15",
            "tlsh": "38f0a6a43ce5d92f603a26a3517ad588762026123412a09e7b8c5d761962fd52e01d6e",
            "path": "src/license.ts"
        },
        {
            "sha256": "0a7262584f2fb7704275a3f03be4403fec4dd180f23e23f6025221f7f688d613",
            "tlsh": "cac08cc30247d00b30f896c9001bd0afa3b0005f3a21702323030b3c8093ca02a0128c",
            "path": "src/index.ts"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "e59faa2636b3d36b1959a4751950568be80fda34",
                "sha512_sri": "sha512-RYuIC2iJyU5SfTkXespzK7QXbcPOe544DW+B6ndaZX5PnHzLDZ0qmteTG5+h1zNxmPeot8YOOVm3RgKf3PEqdA=="
            },
            "filename": "maplibre-gl-vue3-1.0.0.tgz"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/maplibre-gl-vue3/MAL-2026-6592.json"