commonjs-code-token

{"modified":"2026-08-26T14:23:41Z","published":"2026-08-26T14:18:32Z","schema_version":"1.7.4","id":"MAL-2026-14534","summary":"Malicious code in commonjs-code-token (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c6ab469a55ec3f0650bc2185b91e884304cf1e370b1e17992a328479ce4883ad)\nOn npm install, the package's postinstall hook runs index.js, which fetches JSON from https://access-token-delta.vercel.app and passes the returned `token` field directly to eval(). Whoever controls that endpoint obtains arbitrary code execution on the installing machine, and the fetched content is mutable at any time. The package advertises itself with a README for an unrelated multithreaded cache library (node-cache-multithread) while the actual package identity is commonjs-code-token, a metadata/behavior mismatch consistent with a cover story. No legitimate functionality is shipped in the package.\n","affected":[{"package":{"ecosystem":"npm","name":"commonjs-code-token"},"versions":["1.0.1","1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"fab0bce00f76c152ff99494b36981c87ed6617089c800a1183f85a8f2845e506","tlsh":"46c08cba407932349a6a46cc916a203b28a4810838a0cc52830d5b885ea3d4184a3cd9"},{"path":"README.md","sha256":"2c066039b2b59c6f9a613e9a79bacbb75226fc9a99a9f6070890c68ee55d8403","tlsh":"c411d486062be2e227625beb14e58181bf3ba66d17400410e92fd49c915ddf8137f5bd"}],"package_integrity":[{"filename":"commonjs-code-token-1.0.1.tgz","hashes":{"sha1":"cba585cbe3cafc616601306ea07f3a5d5b2f4b13","sha512_sri":"sha512-bkVFa2eNUs0kQFQWpTDQKamNtJhycItSbE+ijCO7OOhzboW4Er6A+rxE3Attr6MpV6CTkuWVGKyN6exQQuAapg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/commonjs-code-token/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/commonjs-code-token/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018754","import_time":"2026-08-26T14:20:37.051613875Z","modified_time":"2026-08-26T14:18:42Z","sha256":"b5f30d280304d5e3e2f52c01495981c888bc161d54342821c90944ee908798d5","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-018753","import_time":"2026-08-26T14:20:37.011021119Z","modified_time":"2026-08-26T14:18:32Z","sha256":"c6ab469a55ec3f0650bc2185b91e884304cf1e370b1e17992a328479ce4883ad","source":"amazon-inspector","versions":["1.0.0"]}]}}