vexium-kit

{"modified":"2026-08-13T17:26:43Z","published":"2026-08-13T17:22:13Z","schema_version":"1.7.4","id":"MAL-2026-13963","summary":"Malicious code in vexium-kit (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (81256cad9a270a808ce5e9cb2d6987aef06c2c236baa7ae76b8172c40ee61dd9)\nOn require, index.js issues an HTTPS request to the hardcoded bare-IP endpoint https://31.97.137.157:45000/icons/116 and passes the response's `credits` field to `new Function('require','module',...,'Promise', data.credits)`, executing operator-controlled JavaScript with `require`, `process`, and `Buffer` in scope. The remote-eval sink is named `getPlugin`, accompanied by an unused `setDefaultModule` decoy referencing font-awesome CDN paths, while the README advertises the package as a zero-dependency utility toolkit. Declared dependencies (`@primno/dpapi`, `better-sqlite3`, `sqlite3`, `node-machine-id`) match the toolkit shape used to decrypt Chromium DPAPI-protected cookies/passwords and read browser Login Data databases, indicating the operator-supplied payload's intended follow-on capability against the installer.\n","affected":[{"package":{"ecosystem":"npm","name":"vexium-kit"},"versions":["10.0.2","2.0.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"27f1466161585c734c5d279e0d8a1582a7ff236f4efc5f7a9c5bf7f7c33f7e5f","tlsh":"2ec1606546fa31a36a67e4eef30f100271a5e3133758e971f58e42902fca568e5f24e8"}],"package_integrity":[{"filename":"vexium-kit-10.0.2.tgz","hashes":{"sha1":"0240baf14c8593b384a5dbb7b4232135c0741c4e","sha512_sri":"sha512-QqtQ+31/dsQtWsuUTChAhvKarVx/mVjxMdJHYDNxBJL6dzg/A9famczeExEoSfaDsRVxzQ6atQqtiDaormMlDw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/vexium-kit/v/10.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/vexium-kit/v/2.0.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017661","import_time":"2026-08-13T17:24:46.334656317Z","modified_time":"2026-08-13T17:22:13Z","sha256":"1686bf2bc5c03717c87c1ff5447e2fc11aa6d2e976e1b14e5edcace286829100","source":"amazon-inspector","versions":["10.0.2"]},{"id":"IN-MAL-2026-017666","import_time":"2026-08-13T17:24:46.512105961Z","modified_time":"2026-08-13T17:22:58Z","sha256":"81256cad9a270a808ce5e9cb2d6987aef06c2c236baa7ae76b8172c40ee61dd9","source":"amazon-inspector","versions":["2.0.2"]}]}}