ventra-kit

{"modified":"2026-08-13T17:21:55Z","published":"2026-08-13T17:21:55Z","schema_version":"1.7.4","id":"MAL-2026-13962","summary":"Malicious code in ventra-kit (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3f023d55f53d30a92c8f06ca661862ee99d338f6d3719247c9390b3169009702)\nThe package's default export (module.exports = () => getPlugin()) issues an HTTPS request to a hardcoded bare-IP host at 31.97.137.157:45000/icons/116 and passes the response's `credits` field into `new Function('require','module','exports',...,'Promise', data.credits)`, executing attacker-controlled JavaScript with full Node.js capabilities (require, process, Buffer, globals). The destination URL is assembled from split protocol/separator/domain/path constants, and an unused `iconDomain` map (cloudflare/fastly/akamai) plus a `setDefaultModule` helper referencing cdnjs/font-awesome provide cover-story framing that disguises the loader as an icon CDN helper. Declared dependencies (@primno/dpapi, better-sqlite3, node-machine-id) are consistent with a Windows browser-credential stealer to be delivered as the remote payload. Any consumer that requires ventra-kit and invokes the default export receives remote code execution on the installer's machine.\n","affected":[{"package":{"ecosystem":"npm","name":"ventra-kit"},"versions":["1.0.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"27f1466161585c734c5d279e0d8a1582a7ff236f4efc5f7a9c5bf7f7c33f7e5f","tlsh":"2ec1606546fa31a36a67e4eef30f100271a5e3133758e971f58e42902fca568e5f24e8"}],"package_integrity":[{"filename":"ventra-kit-1.0.2.tgz","hashes":{"sha1":"bbcaed1cc185137dfd30c8f055847537f288f7c3","sha512_sri":"sha512-yPaqiRvSDJTLJKR5T4Y7k3z3q+jKaHvLf0CbgL22MJ1mQh54Wn++faJNx7v/igYyUMy2PR5rgSpCJsAKmn6+mA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/ventra-kit/v/1.0.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017659","import_time":"2026-08-13T17:24:46.267750378Z","modified_time":"2026-08-13T17:21:55Z","sha256":"3f023d55f53d30a92c8f06ca661862ee99d338f6d3719247c9390b3169009702","source":"amazon-inspector","versions":["1.0.2"]}]}}