npm-module-service

{"schema_version":"1.7.4","id":"MAL-2026-12404","published":"2026-08-05T13:03:06Z","modified":"2026-09-24T09:23:27.911401559Z","summary":"Malicious code in npm-module-service (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8000a7baeda176481fd23b624485b3e419d6bed7f954900229de069c8ec4e026)\nThe default export getPlugin in index.js performs an HTTPS request to the hardcoded bare-IP endpoint https://46.183.25.232:45000/icons/107 and passes the returned data.credits field to a Function constructor invoked with require, module, process, Buffer, and Promise bound in scope. Any consumer that imports and calls the module executes attacker-supplied JavaScript with full Node.js privileges on the installer's host. The URL is assembled from separated protocol/domain/path variables, and identifiers such as iconDomain, font-awesome, cdnjs, and bearrtoken, together with a decoy setDefaultModule function, present the module as a CDN icon helper while the actual network target is an unauthenticated bare-IP host unrelated to any CDN.\n","affected":[{"package":{"name":"npm-module-service","ecosystem":"npm"},"versions":["3.7.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"647bdf81eaddc6e1296010cbbaeedf0f9c3bf72dc3e91e04944a8e374a562fe3","tlsh":"94c1616546fa31a36a67e4edf30f10027165e313365de971f48e42902fca568e5f24e8"}],"package_integrity":[{"filename":"npm-module-service-3.7.2.tgz","hashes":{"sha1":"ee17455b0a14a556ee14774e27a5f7fb83c593b2","sha512_sri":"sha512-WCMr/KOaH269lYTsOQA8+/d5jFSLrScJ39FVKZuOnunW6Zzaund7iOdrP810M1oFfdgzDUJdPhk+/H8FmMPrlg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/npm-module-service/v/3.7.2"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014863","import_time":"2026-08-05T13:08:51.744845513Z","modified_time":"2026-08-05T13:03:06Z","sha256":"8000a7baeda176481fd23b624485b3e419d6bed7f954900229de069c8ec4e026","source":"amazon-inspector","versions":["3.7.2"]},{"id":"RLMA-2026-10766","import_time":"2026-09-24T09:21:35.011873286Z","modified_time":"2026-09-22T17:34:18Z","sha256":"d4e4093ceb644548a685efa3d647dae0d3a17db50d40ffd6da9a7b95dda51b69","source":"reversing-labs","versions":["3.7.2"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}