umber-root

{"modified":"2026-08-05T14:22:16Z","published":"2026-08-05T13:15:05Z","schema_version":"1.7.4","id":"MAL-2026-12814","summary":"Malicious code in umber-root (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a16b80d2c76699beaf0773da7233c1e136a951a8edd0ba84b073ea78590c23e1)\nThe npm postinstall lifecycle hook runs dist/config.js, which fetches JSON from https://my-api.trade-api.workers.dev?id=3 and then invokes `globalThis[data.success](data.id)`, letting the remote endpoint choose which global (eval, Function, require, etc.) to call and with what argument. The package reassigns `globalThis.require = require` earlier in the same file to make `require` reachable through this indirection. The result is arbitrary code execution on every installer machine during `npm install`, with both the executor and its argument supplied by an attacker-controlled Cloudflare Workers endpoint. The package advertises itself as a color toolkit; there is no build or configuration purpose served by a network-dispatched global invocation, and the string-indexed global lookup is an evasion pattern that hides the sink from static scanners.\n","affected":[{"package":{"ecosystem":"npm","name":"umber-root"},"versions":["1.1.0","1.1.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/config.js","sha256":"845eb298bf47e23bab8dd59f0182977c16a384dbd2feb79327816ee66becef6d","tlsh":"00d0977bc2cda028681070dde0090624b583e562cb3ec82bfa2deee2dce5964ea41134"}],"package_integrity":[{"filename":"umber-root-1.1.0.tgz","hashes":{"sha1":"e76577421aa382e0a05e04d9a4e2455003341496","sha512_sri":"sha512-8Rsj6uFxJGKalCnrdhk3Pqc2DtUJweekrpz3FobPlavqRj85AwB7eALGuLyjTizlxRiFA6zoK5S0EDmsbNG2dg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/umber-root/v/1.1.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/umber-root/v/1.1.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014943","import_time":"2026-08-05T14:19:45.287063814Z","modified_time":"2026-08-05T13:15:05Z","sha256":"a16b80d2c76699beaf0773da7233c1e136a951a8edd0ba84b073ea78590c23e1","source":"amazon-inspector","versions":["1.1.0"]},{"id":"IN-MAL-2026-014945","import_time":"2026-08-05T14:19:45.50513503Z","modified_time":"2026-08-05T13:15:23Z","sha256":"a47da1a0e6cc80e91ba29f2baff3c412926050d2f5cff1441102734b96592769","source":"amazon-inspector","versions":["1.1.2"]}]}}