MAL-2026-6702

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/vue-demi-fix/MAL-2026-6702.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6702
Published
2026-06-30T10:41:28Z
Modified
2026-07-01T19:16:50.068014111Z
Summary
Malicious code in vue-demi-fix (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3bf683b6e8715fecd451a06da256d90048054cbe463da64e43c1a8db4226b661)

vue-demi-fix is a name-confusion package against the widely used vue-demi library. package.json declares both preinstall and postinstall lifecycle scripts that invoke curl against a hardcoded bare-IP HTTP endpoint (http://109.71.252.153:8080/), exfiltrating the installer's OS, username (whoami), current working directory (pwd), and hostname as URL query parameters on every npm install. The package ships no real functionality — index.js only prints a proof-of-concept notice and README self-labels as a 'Responsible Disclosure' PoC. Regardless of the PoC framing, installers receive no benign function and their host identity is unconditionally beaconed to a non-publisher, non-registry endpoint on a default install.

Source: ossf-package-analysis (8fd5381cd4364444dac8d64b33e317c526ef52948ebfb9d10e11ec0909b7d383)

The OpenSSF Package Analysis project identified 'vue-demi-fix' @ 10.0.4 (npm) as malicious.

It is considered malicious because:

  • The package executes one or more commands associated with malicious behavior.
Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "10.0.4"
            ],
            "sha256": "8fd5381cd4364444dac8d64b33e317c526ef52948ebfb9d10e11ec0909b7d383",
            "modified_time": "2026-06-30T10:41:28Z",
            "source": "ossf-package-analysis",
            "import_time": "2026-06-30T21:35:44.631242273Z"
        },
        {
            "versions": [
                "10.0.4"
            ],
            "sha256": "3bf683b6e8715fecd451a06da256d90048054cbe463da64e43c1a8db4226b661",
            "source": "amazon-inspector",
            "modified_time": "2026-07-01T18:34:29Z",
            "import_time": "2026-07-01T19:11:22.756129232Z",
            "id": "IN-MAL-2026-007842"
        },
        {
            "versions": [
                "10.0.3"
            ],
            "sha256": "41d430d87db19b144ee6213294cc5dd634b60288db5dd1c9ba6d57e23d90140c",
            "source": "amazon-inspector",
            "modified_time": "2026-07-01T18:34:46Z",
            "import_time": "2026-07-01T19:11:23.067617477Z",
            "id": "IN-MAL-2026-007844"
        },
        {
            "versions": [
                "10.0.5"
            ],
            "sha256": "de927f8bd731d104d0cd6444386a8c9a050331d85b1de57a14bee2c7f4baa0e7",
            "source": "amazon-inspector",
            "modified_time": "2026-07-01T18:34:39Z",
            "import_time": "2026-07-01T19:11:22.90478316Z",
            "id": "IN-MAL-2026-007843"
        }
    ]
}
References
Credits

Affected packages

npm / vue-demi-fix

Package

Name
vue-demi-fix
View open source insights on deps.dev
Purl
pkg:npm/vue-demi-fix

Affected ranges

Affected versions

10.*
10.0.3
10.0.4
10.0.5

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "vue-demi-fix-10.0.4.tgz",
            "hashes": {
                "sha512_sri": "sha512-sOGDhqSQeq3Ki7DOeFTqutfY0sf72I9I/fMSaj43mWQWNnerwv+7aCGX4kqSvx7VlJTGd4qPczAHTvYbLFvoxQ==",
                "sha1": "4e8b755465d097a5dfc9515df2eaa015bd7703df"
            }
        }
    ],
    "evidence_files": [
        {
            "sha256": "1df317c182d5e7b522b207299f68c0e75e79c4697c009e69b256410bd6335779",
            "path": "package.json",
            "tlsh": "49f028382834a6333ac54f20686576efac417f730191bc15e7a3a51ddaae29202b9219"
        },
        {
            "sha256": "58b31f2aade66367cf38caf6f10806a270f3be88b9cdfc5f1c8524d01ac44479",
            "path": "README.md",
            "tlsh": "20a022333008ba0823303a030ae00a002a000c22bf88a080c80be880820c0c08a8833a"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/vue-demi-fix/MAL-2026-6702.json"
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]