@leonardo0902/vortex-kit

{"modified":"2026-08-13T17:22:30Z","published":"2026-08-13T17:22:30Z","schema_version":"1.7.4","id":"MAL-2026-13939","summary":"Malicious code in @leonardo0902/vortex-kit (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1707e031a6c470479ecbd0b01a480cc801a9d049a3732abc265ccad8791272a9)\nThe main module in @leonardo0902/vortex-kit@12.0.2 issues an HTTPS request to a hardcoded bare-IP endpoint at 31.97.137.157:45000/icons/116 and passes the returned `credits` field to `new Function('require',..., 'Promise', data.credits)`, executing attacker-controlled JavaScript with full Node context (require, process, Buffer) whenever the module is loaded and its exported function is invoked. The fetch destination is disguised as a static-asset endpoint: the file defines a decoy `setDefaultModule` referencing legitimate CDNs (cloudflare, fastly, akamai, cloudfront) and a font-awesome path, then reuses the identical variable names (`protocol`, `domain`, `path`, `head`, `bearrtoken: 'logo'`) around the bare-IP fetch-and-eval to frame it as an icon download. Bundled native dependencies (@primno/dpapi, better-sqlite3, node-machine-id) are consistent with a dynamically delivered browser-credential-stealer payload. The remote code is unpinned, unverified, and controlled entirely by whoever operates the IP.\n","affected":[{"package":{"ecosystem":"npm","name":"@leonardo0902/vortex-kit"},"versions":["12.0.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"27f1466161585c734c5d279e0d8a1582a7ff236f4efc5f7a9c5bf7f7c33f7e5f","tlsh":"2ec1606546fa31a36a67e4eef30f100271a5e3133758e971f58e42902fca568e5f24e8"}],"package_integrity":[{"filename":"vortex-kit-12.0.2.tgz","hashes":{"sha1":"4e7433d0df8a05684f82aa353d98aa0bcb992e11","sha512_sri":"sha512-zx1ZtlqiigjXNnNjqlhvfC91nwZLF2Kp+B8dpFGQaHhyTuvQV9Iw/R5bOZ2KWXUIUh2gRc+43LcaDi+ZCAL+ZA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@leonardo0902/vortex-kit/v/12.0.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017663","import_time":"2026-08-13T17:24:46.414628498Z","modified_time":"2026-08-13T17:22:30Z","sha256":"1707e031a6c470479ecbd0b01a480cc801a9d049a3732abc265ccad8791272a9","source":"amazon-inspector","versions":["12.0.2"]}]}}