MAL-2026-14268

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/no-for-of-loops/MAL-2026-14268.json
JSON Data
https://api.test.osv.dev/v1/vulns/MAL-2026-14268
Published
2026-08-19T06:22:58Z
Modified
2026-08-19T07:00:15.489812188Z
Summary
Malicious code in no-for-of-loops (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (08feaf6617a902e503390720b41d226364ba3bc125d298eb296a2d3e30d5b6d5)

package.json declares no-for-of-loops as its own dependency and devDependency, with the source pointed at http://pack.nppacks.com/npm/no-for-of-loops instead of the npm registry. On npm install, npm fetches a tarball from this host over unauthenticated plain HTTP with no integrity hash, and installs its contents into the consumer's node_modules. The domain operator can serve arbitrary, mutable bytes on each fetch, meaning any code shipped from that host runs inside the installer's dependency tree. The main module's header additionally self-identifies the package as a 'Security Research Testing Purpose' artifact, and the package description is a bare 'NPM', consistent with a hijack-vector proof-of-concept rather than a functional utility. The auto-execute condition is satisfied: any default npm install of this package resolves and installs the attacker-controlled tarball without user opt-in.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-018381",
            "import_time": "2026-08-19T06:49:44.39761579Z",
            "modified_time": "2026-08-19T06:22:58Z",
            "source": "amazon-inspector",
            "sha256": "08feaf6617a902e503390720b41d226364ba3bc125d298eb296a2d3e30d5b6d5",
            "versions": [
                "1.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / no-for-of-loops

Package

Name
no-for-of-loops
View open source insights on deps.dev
Purl
pkg:npm/no-for-of-loops

Affected ranges

Affected versions

1.*
1.0.1

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "package.json",
            "tlsh": "66f0f60cde21aa5748ca396d99275a42b2767e675818fe1832c7973c0b4d0fb60f929c",
            "sha256": "9898595aa3e08330461d2cfe9de8412a293420b480b4d51632a0dec4d7b02aa9"
        },
        {
            "path": "index.js",
            "sha256": "f2fcebdb4f0e41365a39ca87a52fcc4e6abd5633fe6272e60d1386d26b90ef41",
            "tlsh": "71a1935ab5e0159745aa22e5b3ce48b577bd80b3330df5a0b54cbf563f40c348a1aed1"
        }
    ],
    "package_integrity": [
        {
            "filename": "no-for-of-loops-1.0.1.tgz",
            "hashes": {
                "sha1": "5934f580a9bdda1d499a74a35b4034b04d4af738",
                "sha512_sri": "sha512-zK1v5Nb/8sLnxxB2KS5pyZ9Ja0UIxDfPPJHwoCWMYec0X/sx2iYLIDi+cc7rkGN4Iz4b1lTmZZne1vrhAhdVDg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/no-for-of-loops/MAL-2026-14268.json"