de-morgan

{"modified":"2026-08-19T06:20:50Z","published":"2026-08-19T06:20:50Z","schema_version":"1.7.4","id":"MAL-2026-14264","summary":"Malicious code in de-morgan (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (93cdcef4435e4bbb8f5841076c9294b934eaebd268286204a37cab9c334a045f)\npackage.json declares both a `dependencies` and `devDependencies` entry for `de-morgan` pointing at `http://pack.nppacks.com/npm/de-morgan`, a non-npm-registry host reached over plain HTTP with no version pin or integrity check. On `npm install`, npm fetches and installs whatever tarball is served from that URL into the dependency graph, executing any lifecycle scripts it contains. The visible index.js is a clone of babel-plugin-transform-define and carries a top-of-file comment stating `This package use for Security Research Testing Purpose.`, but the shipped manifest wires in an attacker-controlled, mutable, plaintext delivery URL under a lookalike domain (`nppacks.com`), so the installed code path is whatever the remote host currently serves rather than the benign in-tree source.\n","affected":[{"package":{"ecosystem":"npm","name":"de-morgan"},"versions":["2.1.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"b369c0ab04fd98252b20397292c07f14320cd3e541f3d656fab479c8f3eb9088","tlsh":"00f08b48ce31a923c4c621545d760643e33959874018fd0c3ae7675c8b8c0bb24f82de"},{"path":"index.js","sha256":"f2fcebdb4f0e41365a39ca87a52fcc4e6abd5633fe6272e60d1386d26b90ef41","tlsh":"71a1935ab5e0159745aa22e5b3ce48b577bd80b3330df5a0b54cbf563f40c348a1aed1"}],"package_integrity":[{"filename":"de-morgan-2.1.3.tgz","hashes":{"sha1":"3d0086b868cdf0cd5e2729892002fd42a814e7f9","sha512_sri":"sha512-ZjNVK4G/PpYPeFkxOL7Cav+q7+SSLdpT7KzGZsIZxjR319gsM7p3o7lBojAAHAoOEC932OPNezlJGwBTxshbpQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/de-morgan/v/2.1.3"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018379","import_time":"2026-08-19T06:49:44.300860598Z","modified_time":"2026-08-19T06:20:50Z","sha256":"93cdcef4435e4bbb8f5841076c9294b934eaebd268286204a37cab9c334a045f","source":"amazon-inspector","versions":["2.1.3"]}]}}