MAL-2026-14346

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@next-fonts/font/MAL-2026-14346.json
JSON Data
https://api.test.osv.dev/v1/vulns/MAL-2026-14346
Published
2026-08-21T04:28:59Z
Modified
2026-08-21T05:01:52.384488988Z
Summary
Malicious code in @next-fonts/font (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (4e536e77176d5fb4637105c50280763e82a6a273dd7de35bb82da340b0f71163)

@next-fonts/font is a typosquat of Next.js's @next/font. Its exported Inter() function (mimicking next/font/google) decodes a base64 blob via atob(), then executes it through spawn('node','-e', code) with an eval(code) fallback. The decoded payload uses on-chain data as a C2 channel: it queries api.trongrid.io or fullnode.mainnet.aptoslabs.com for a transaction tied to hardcoded wallet addresses, retrieves that transaction's input data from BSC RPC endpoints (bsc-dataseed.binance.org, bsc-rpc.publicnode.com) via eth_getTransactionByHash, XOR-decrypts the returned bytes, and evals the resulting JavaScript. The result is arbitrary attacker-controlled code execution on any Node process that imports the package and invokes Inter(), with no relation to font functionality. Obfuscation (base64-hidden payload, node -e detached spawn with eval fallback, blockchain-mediated fetch) conceals the downloader from casual inspection.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-018501",
            "versions": [
                "1.0.1"
            ],
            "modified_time": "2026-08-21T04:28:59Z",
            "sha256": "1165fecff800f58383c09762935267dddab4d21d37f6166d4e3ceaf0d9175191",
            "import_time": "2026-08-21T04:48:53.490398489Z",
            "source": "amazon-inspector"
        },
        {
            "id": "IN-MAL-2026-018502",
            "sha256": "4e536e77176d5fb4637105c50280763e82a6a273dd7de35bb82da340b0f71163",
            "modified_time": "2026-08-21T04:29:07Z",
            "versions": [
                "1.0.0"
            ],
            "import_time": "2026-08-21T04:48:53.529322071Z",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / @next-fonts/font

Package

Name
@next-fonts/font
View open source insights on deps.dev
Purl
pkg:npm/%40next-fonts/font

Affected ranges

Affected versions

1.*
1.0.0
1.0.1

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "aaf3d79dad11e28c542b6c821d40eb94ae567540fa0b0f220758298261a2a226",
            "path": "index.js",
            "tlsh": "94712bbcd0b63a85053d669299dd1acef27eac6774794b04b77e1fc647208e1007366c"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-mKukNtzq9ABPKoKS9vJb/MlymD0QHFySGNN4GfBQqFrtEVQwKGCfAUMGn8XsSGsr9L+aEsLqC2tE5dos0BDJ/w==",
                "sha1": "8cc67cdd396f5dcd2c0c42155687aeadee2ef955"
            },
            "filename": "font-1.0.1.tgz"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@next-fonts/font/MAL-2026-14346.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]