@next-fonts/font

{"modified":"2026-08-21T04:50:41Z","published":"2026-08-21T04:28:59Z","schema_version":"1.7.4","id":"MAL-2026-14346","summary":"Malicious code in @next-fonts/font (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4e536e77176d5fb4637105c50280763e82a6a273dd7de35bb82da340b0f71163)\n@next-fonts/font is a typosquat of Next.js's @next/font. Its exported Inter() function (mimicking next/font/google) decodes a base64 blob via atob(), then executes it through spawn('node','-e', code) with an eval(code) fallback. The decoded payload uses on-chain data as a C2 channel: it queries api.trongrid.io or fullnode.mainnet.aptoslabs.com for a transaction tied to hardcoded wallet addresses, retrieves that transaction's input data from BSC RPC endpoints (bsc-dataseed.binance.org, bsc-rpc.publicnode.com) via eth_getTransactionByHash, XOR-decrypts the returned bytes, and evals the resulting JavaScript. The result is arbitrary attacker-controlled code execution on any Node process that imports the package and invokes Inter(), with no relation to font functionality. Obfuscation (base64-hidden payload, node -e detached spawn with eval fallback, blockchain-mediated fetch) conceals the downloader from casual inspection.\n","affected":[{"package":{"ecosystem":"npm","name":"@next-fonts/font"},"versions":["1.0.1","1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"aaf3d79dad11e28c542b6c821d40eb94ae567540fa0b0f220758298261a2a226","tlsh":"94712bbcd0b63a85053d669299dd1acef27eac6774794b04b77e1fc647208e1007366c"}],"package_integrity":[{"filename":"font-1.0.1.tgz","hashes":{"sha1":"8cc67cdd396f5dcd2c0c42155687aeadee2ef955","sha512_sri":"sha512-mKukNtzq9ABPKoKS9vJb/MlymD0QHFySGNN4GfBQqFrtEVQwKGCfAUMGn8XsSGsr9L+aEsLqC2tE5dos0BDJ/w=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@next-fonts/font/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@next-fonts/font/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018501","import_time":"2026-08-21T04:48:53.490398489Z","modified_time":"2026-08-21T04:28:59Z","sha256":"1165fecff800f58383c09762935267dddab4d21d37f6166d4e3ceaf0d9175191","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-018502","import_time":"2026-08-21T04:48:53.529322071Z","modified_time":"2026-08-21T04:29:07Z","sha256":"4e536e77176d5fb4637105c50280763e82a6a273dd7de35bb82da340b0f71163","source":"amazon-inspector","versions":["1.0.0"]}]}}