route-processor

{"modified":"2026-07-28T05:03:24Z","published":"2026-07-13T19:46:50Z","schema_version":"1.7.4","id":"MAL-2026-10483","aliases":["GHSA-8mrq-4593-6x5p"],"summary":"Malicious code in route-processor (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (430b2eaa9fcc780c6e6a20639c32767b24ca2d47ba708c056c68bc78fb03e425)\nThe package's default export builds a URL from split constants (protocol/separator/domain/path/token resolving to https://svganchordev.net/icons/107), fetches JSON from that host, and passes the response field data.credits directly to new Function(...) which is then invoked with a require-capable evalContext. Any consumer calling the default export executes arbitrary JavaScript delivered live by svganchordev.net with full Node capabilities (require, process, Buffer, cwd). The URL is deliberately reassembled from separate string constants rather than written as a literal, concealing the endpoint from casual inspection. The package advertises itself as a React helper for HTTPS route processing and SVG generation, but declares runtime dependencies on @primno/dpapi (Windows DPAPI decryption used to unwrap Chrome/Edge-protected secrets), better-sqlite3 and sqlite3 (used to read browser Login Data / Cookies databases), and node-machine-id (host fingerprinting). These dependencies have no role in the advertised functionality; they are the primitives the remotely-fetched code loads via require to harvest browser-stored credentials from the installer's machine.\n\n## Source: ghsa-malware (2b5ee11238bb9d63548b3cf376cb20ceb61dea54ed114e54d1cf694d5af1dba3)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"ecosystem":"npm","name":"route-processor"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["3.1.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"f03baeca30cfcbb5903b1d93435435be75b45695cae2510970d803a09ba7071d","tlsh":"3ac1616546fa31a36a67e4edf30f10027165e3133759e971f48e42902fca568e5f24e8"},{"path":"package.json","sha256":"e890a98a85097ea09a8a30030898dce79df38651ba12aa43765d30a687c46739","tlsh":"b7f02810de24de7315d61296a8284087a160d80b4f00fc0d379ac65d4f8e47f26fe75d"}],"package_integrity":[{"filename":"route-processor-3.1.5.tgz","hashes":{"sha1":"bf0e3b909c6e8fb4908ad914f8059326be654f4b","sha512_sri":"sha512-qXavtvYHMgWprxPvpRSZUpg8wDbySdKg7gkE0RnTKxfyXUKD9bQeqvC+KI3nObYhoeZ2lFW9lqCMn79F5J8TLw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/route-processor/v/3.1.5"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-8mrq-4593-6x5p"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","sha256":"430b2eaa9fcc780c6e6a20639c32767b24ca2d47ba708c056c68bc78fb03e425","import_time":"2026-07-13T20:29:54.006777436Z","id":"IN-MAL-2026-010300","modified_time":"2026-07-13T19:46:50Z","versions":["3.1.5"]},{"source":"ghsa-malware","sha256":"2b5ee11238bb9d63548b3cf376cb20ceb61dea54ed114e54d1cf694d5af1dba3","import_time":"2026-07-28T02:02:03.018846Z","id":"GHSA-8mrq-4593-6x5p","modified_time":"2026-07-27T12:47:56Z","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]}]}}