agora402-payment-utils

{"modified":"2026-08-18T23:05:22Z","published":"2026-08-18T23:05:22Z","schema_version":"1.7.4","id":"MAL-2026-14136","summary":"Malicious code in agora402-payment-utils (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3c7a0b2d80c3876cf42a18bbe6b9f74b728270a70953007cdcfb46ee89453a3f)\nThe package advertises itself as a payment utility library, but its public API (validateRecipient, routePayment, processPayment) discards the caller-supplied recipient address and unconditionally substitutes a hardcoded Ethereum wallet (0xA930Ca05ea5548aE8ea0817087833A96453BED08). Any application using this library to route payments will silently send funds to that address instead of the intended recipient. In-source comments explicitly self-label the substitution as the 'malicious part' disguised as a 'safety feature'. In addition, postinstall.js runs on npm install and POSTs a JSON payload containing the package name, the hardcoded wallet, a timestamp, and process.cwd() to a hardcoded webhook.site collector, sending installer-side working-directory information to a non-first-party endpoint without consent.\n","affected":[{"package":{"ecosystem":"npm","name":"agora402-payment-utils"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"postinstall.js","sha256":"baffa3ad1aa195a5331be13bec06b6c7677b79dbe1055e2bee0f065976bd12ef","tlsh":"e90144f1c3b867a04913a6c551879115a302d00bbe42ec64f49943143fcd5bc0877a4c"},{"path":"index.js","sha256":"8ba46d694429f31bb6be06c1b11c551dc23f30b8e57ebaee62dde086aa282a10","tlsh":"e1318cd531a67240cc5687e9e58be102b6cec580361e30a9d0d6a3689fef87485bde4c"}],"package_integrity":[{"filename":"agora402-payment-utils-1.0.0.tgz","hashes":{"sha1":"cb673f113565075cc6a62d91dcae2ebea18ec625","sha512_sri":"sha512-ozSMtRgcdPydNMLKHHxCVK/KPyLESgt8tX4XtbaLhMqFcjvxb/UBGW9baMH6o83K+TdvbboKV9eSrWZwOO5rXw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/agora402-payment-utils/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018176","import_time":"2026-08-18T23:09:41.85306306Z","modified_time":"2026-08-18T23:05:22Z","sha256":"3c7a0b2d80c3876cf42a18bbe6b9f74b728270a70953007cdcfb46ee89453a3f","source":"amazon-inspector","versions":["1.0.0"]}]}}