gas-monitor

{"modified":"2026-08-31T16:41:24Z","published":"2026-08-31T16:41:24Z","schema_version":"1.7.4","id":"MAL-2026-15621","summary":"Malicious code in gas-monitor (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b218a26d55f47d2b60f56267a03c299dbed364fe6393cd2f1230f364020bc79e)\ngas-monitor@1.1.0 impersonates eth-gas-reporter (author field set to `cgewecke`, source tree mirrored, README pivoted to generic 'multi-chain gas analytics' marketing). index.js exports `log` as a mocha reporter; inside, a `var opt = 1; if (!opt) {...real reporter... } else { gestest(); }` guard makes the legitimate reporter branch unreachable and unconditionally invokes `utils.connectNet(...)`, which detached-spawns `node lib/syncResolve.js`. lib/syncResolve.js fetches a JavaScript string from https://api.jsonbin.io/v3/b/6a93356ada38895dfe21087c and executes it via `new Function.constructor('require', result)(require)`, giving the operator of the jsonbin record arbitrary Node code execution with the caller's `require` handle on any host that loads the reporter. The jsonbin record is author-mutable, so the executed payload can change without republishing the package.\n","affected":[{"package":{"ecosystem":"npm","name":"gas-monitor"},"versions":["1.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/syncResolve.js","sha256":"0b804d0c5fe35a50fdc94dda1e5d7d60f8eb8dbb0ad7ce0e7ec728a2812f3aa0","tlsh":"22019c9e3469f0180ef012e5db176022e6025f263107b1d5729d97521f7ada85602eec"},{"path":"index.js","sha256":"db6f048ab50bdad5c12883185a63f731a1ff1f9d98055ea63e34e9d28137415f","tlsh":"b3f1fe322eb7153745e3faac9bcba061d12696372201cfad7a8c93104f5447894efbe4"}],"package_integrity":[{"filename":"gas-monitor-1.1.0.tgz","hashes":{"sha1":"4851b05f46041a661ef331baf1830cbdb9548d50","sha512_sri":"sha512-EktXf4HZva+wBeu4aWLvkByZrb0DJWJ3VShsZG23sI0TqPZkbIFauX2pgTWp0gmXggI3qcw4jZzkRxHKMVhFbw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/gas-monitor/v/1.1.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019154","import_time":"2026-08-31T17:16:12.437653749Z","modified_time":"2026-08-31T16:41:24Z","sha256":"b218a26d55f47d2b60f56267a03c299dbed364fe6393cd2f1230f364020bc79e","source":"amazon-inspector","versions":["1.1.0"]}]}}