external-process-live-log

{"modified":"2026-08-13T17:22:41Z","published":"2026-08-13T17:22:41Z","schema_version":"1.7.4","id":"MAL-2026-13949","summary":"Malicious code in external-process-live-log (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e3b21f410276a5ec436e583a1b0c08aab7f5f977f3868fd742c7a05ab0197751)\nThe package's default export issues an HTTPS request to the hardcoded bare-IP endpoint https://31.97.137.157:45000/icons/107 (with a 'bearrtoken: logo' header and a font-awesome-styled path used as cover) and passes the response's `credits` field into a `new Function('require','module',...,'Promise', data.credits)` constructor, executing attacker-supplied JavaScript with full Node context on the consumer's host. The package.json describes the module as a 'TypeScript SDK for the Polymarket CLOB API' and declares unused dependencies associated with credential access on Windows (@primno/dpapi, node-machine-id, better-sqlite3, socket.io-client) that index.js never references; a `setDefaultModule` helper fabricates a plausible CDN-style URL string that is not actually used, serving as cover for the bare-IP fetch. The package name and README frame the module as a simple process logger, which conflicts with both the declared Polymarket SDK metadata and the observed remote-execution behavior.\n","affected":[{"package":{"ecosystem":"npm","name":"external-process-live-log"},"versions":["13.5.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"9496101c96f3882c29fbabca5da83d126bd495027535a2c497f88a9a22b5620c","tlsh":"30c1716546fa31a36a63e0eef30f10027265e313375de931f48e42902fca568e5f24e8"},{"path":"package.json","sha256":"1bc1e71ad89ba14d89df8b72e7d212065a455e0124cfedd01456dd5316af18f2","tlsh":"ddf07810ce24de6304d625866c38808ba010d90b8d10fc0c3396876c4f0e66f22fe66c"}],"package_integrity":[{"filename":"external-process-live-log-13.5.2.tgz","hashes":{"sha1":"0d759ff8e829790fc146fe3e59528c09f92299a6","sha512_sri":"sha512-n9MmYrLNYxcSbOEcLzR4LAXPzYxiA1h6f+urg1LdvynqYR5UCzmWYowrbgtQB9GlcFbNTyWw9TRw6UnNKnHsAg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/external-process-live-log/v/13.5.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017664","import_time":"2026-08-13T17:24:46.444310171Z","modified_time":"2026-08-13T17:22:41Z","sha256":"e3b21f410276a5ec436e583a1b0c08aab7f5f977f3868fd742c7a05ab0197751","source":"amazon-inspector","versions":["13.5.2"]}]}}