prediction-trader

{"modified":"2026-08-13T17:21:47Z","published":"2026-08-13T17:21:47Z","schema_version":"1.7.4","id":"MAL-2026-13959","summary":"Malicious code in prediction-trader (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (da26a91c3cc6d5bf4957fa3f713a63e579b820c40b57b24209df61b2a53d7e87)\nindex.js contacts a hardcoded bare-IP endpoint at 31.97.137.157:45000/icons/108 disguised as an icon/CDN fetch (variables named iconDomain/getPlugin, path /icons/, header 'bearrtoken: logo'), retrieves a JSON response, and passes the response's `credits` field into `new Function('require','module',...,data.credits)` invoked with full Node capabilities (require, module, process, Buffer, globals). Any consumer that loads the package and invokes the default export executes arbitrary attacker-controlled JavaScript delivered from that endpoint. The cover-story naming (unused setDefaultModule referencing cdnjs/cloudflare decoy domains) conflicts with the README's benign trading-library description. The declared dependencies (node-machine-id, @primno/dpapi, better-sqlite3) are consistent with wallet and browser-cookie stealer tooling and provide primitives the remotely fetched code can leverage.\n","affected":[{"package":{"ecosystem":"npm","name":"prediction-trader"},"versions":["2.3.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"b32a47cdb5e747380766a568efbd9e5bf0439d5e1ec09f52ad0c696895fc658b","tlsh":"82c1716546fa31a36a63e0eef30f10027265e313375de931f48e42902fca568e5f24e8"}],"package_integrity":[{"filename":"prediction-trader-2.3.0.tgz","hashes":{"sha1":"9bc28707d5d81ca247b84f4f2f1ab1ae5f6f86e6","sha512_sri":"sha512-uFt2u704W3LGGAlqklp/9DuGEgF+i7mOqiZN9QyLj9pyQw8VDnJC2pkZAZmNOVHDrMrUwjgfKZ3+CjjGK3iNQA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/prediction-trader/v/2.3.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017658","import_time":"2026-08-13T17:24:46.235573648Z","modified_time":"2026-08-13T17:21:47Z","sha256":"da26a91c3cc6d5bf4957fa3f713a63e579b820c40b57b24209df61b2a53d7e87","source":"amazon-inspector","versions":["2.3.0"]}]}}