copytrade-core

{"modified":"2026-08-13T17:20:53Z","published":"2026-08-13T17:20:53Z","schema_version":"1.7.4","id":"MAL-2026-13944","summary":"Malicious code in copytrade-core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (00c8773c5727069f87e54d58cd3679252a90ec0fe3de3a1b4adcb9a3bbff68bd)\nindex.js exports a getPlugin function that issues an HTTPS request to the hardcoded bare-IP endpoint https://31.97.137.157:45000/icons/108, takes the response's `credits` field, passes it to `new Function('require','module',...,data.credits)`, and invokes it with `require`, `module`, `process`, and `Buffer` injected. This yields arbitrary remote code execution on the consumer's machine, with the fetched payload chosen by whoever controls 31.97.137.157. A separate `setDefaultModule` function assembles a plausible cdnjs/font-awesome URL from a lookup of legitimate CDN domains (cloudflare.com, fastly.net, etc.) but is never invoked; the exported path uses the bare-IP host instead. Declared dependencies include @primno/dpapi (Windows DPAPI decryption), node-machine-id, and better-sqlite3, matching the toolchain of a browser/wallet credential stealer delivered through this loader.\n","affected":[{"package":{"ecosystem":"npm","name":"copytrade-core"},"versions":["2.3.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"b32a47cdb5e747380766a568efbd9e5bf0439d5e1ec09f52ad0c696895fc658b","tlsh":"82c1716546fa31a36a63e0eef30f10027265e313375de931f48e42902fca568e5f24e8"}],"package_integrity":[{"filename":"copytrade-core-2.3.0.tgz","hashes":{"sha1":"ed4f05a486d752bd51cac48d9b8b1bc28c8f0622","sha512_sri":"sha512-eEKA8553mfAHOucAFqWu9zbyEhkva7XRg45/lDzO8GtIBLx+avCoH3wMloJ3ImZvUQxin6xFEyPu5ehwy18qew=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/copytrade-core/v/2.3.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017651","import_time":"2026-08-13T17:24:46.00861372Z","modified_time":"2026-08-13T17:20:53Z","sha256":"00c8773c5727069f87e54d58cd3679252a90ec0fe3de3a1b4adcb9a3bbff68bd","source":"amazon-inspector","versions":["2.3.0"]}]}}