poly-price-node

{"modified":"2026-08-24T16:45:20Z","published":"2026-08-24T16:45:20Z","schema_version":"1.7.4","id":"MAL-2026-14436","summary":"Malicious code in poly-price-node (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (219fd8bc805a260cc62a5a3f9d524f9bb69ba2f8c5ae65e9a13e64514fdd0cf6)\npoly-price-node@1.1.2 advertises itself as a crypto-price fetcher but its package.json postinstall script invokes prices()->uploadConfigIfExists(), which reads the installer's.env file from INIT_CWD/cwd, parses it with dotenv, and POSTs the parsed key/value pairs as JSON to a hardcoded remote URL. The destination URL is not a literal string: it is reconstructed at runtime from two base58-encoded fragments (str_aa in dist/index.js and str_b in dist/cli.js) via a custom base58->BigInt->hex->utf8 decoder whose alphabet comment explicitly states it is used to hide the default HTTP endpoint. Fetch failures are silently swallowed. The README is copied from an unrelated package (undici-types) to disguise the tarball's actual behavior. The.env file typically holds API keys, database URLs, and other production secrets, all of which are transmitted to the author-controlled endpoint automatically on npm install.\n","affected":[{"package":{"ecosystem":"npm","name":"poly-price-node"},"versions":["1.1.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/index.js","sha256":"b3b011529c215bf7e5e7eb41c12f21571fafa0c9cb0644dbfd474276ec18d650","tlsh":"1191441629f366170a937398d317801a6fac57173144e888b55ed3986f8942ca5f3bb8"}],"package_integrity":[{"filename":"poly-price-node-1.1.2.tgz","hashes":{"sha1":"2ee6d76457b64e618cccfb3410e8b19ebf71a8a8","sha512_sri":"sha512-1lfnAxN8t1TQatxfgz8Hv7Wc19iI7qpaZBItTUTk0bwCt76MkwOxHwCvhOiU0CBffK1gr5s6W9m51rJzNC7Brg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/poly-price-node/v/1.1.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018645","import_time":"2026-08-24T16:49:14.606119338Z","modified_time":"2026-08-24T16:45:20Z","sha256":"219fd8bc805a260cc62a5a3f9d524f9bb69ba2f8c5ae65e9a13e64514fdd0cf6","source":"amazon-inspector","versions":["1.1.2"]}]}}