MAL-2026-14369

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@syncraft-labs/vue/MAL-2026-14369.json
JSON Data
https://api.test.osv.dev/v1/vulns/MAL-2026-14369
Published
2026-08-23T03:14:57Z
Modified
2026-08-23T03:30:17.312014990Z
Summary
Malicious code in @syncraft-labs/vue (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d78f28562113db7a203dc694bdff7b3884e8a6e252754b6bd845aab3fefe065f)

The ESM build dist/index.js of @syncraft-labs/vue@0.4.1 contains a heavily obfuscated payload injected alongside the otherwise-legitimate Vue plugin source. The obfuscated region uses an obfuscator.io-style rotating string array (303 entries, 0x240a/0x4963 decoders) and opaque predicates to hide a loader that requires http/https/zlib and childprocess.spawn, queries Ethereum RPC endpoints (publicnode.com/ethereum-rpc, drpc.org/eth, blockscout) and an Etherscan-style txlist endpoint for the hardcoded address 0xa322E5f3..., decodes base64/gzip content from returned transaction data, and passes it to childprocess.spawn. This is the EtherHiding blockchain-hosted C2 dropper pattern: any consumer importing @syncraft-labs/vue via ESM (the package's module entry) resolves an attacker-controlled runtime payload from Ethereum transactions and executes it, yielding remote code execution on the host performing the import. The CJS build and sourcemap are clean, indicating the ESM artifact was tampered after build to smuggle the loader while leaving createSyncraft/useSync and the vue/@syncraft-labs/core imports intact.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-018571",
            "sha256": "d78f28562113db7a203dc694bdff7b3884e8a6e252754b6bd845aab3fefe065f",
            "modified_time": "2026-08-23T03:14:57Z",
            "versions": [
                "0.4.1"
            ],
            "import_time": "2026-08-23T03:25:56.393425317Z",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / @syncraft-labs/vue

Package

Name
@syncraft-labs/vue
View open source insights on deps.dev
Purl
pkg:npm/%40syncraft-labs/vue

Affected ranges

Affected versions

0.*
0.4.1

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "4a7e9651199c579f910cdd265340a07642210674521ab318d5ace809de53dfbf",
            "path": "dist/index.js",
            "tlsh": "24f2a584abd16440034766bfbb1ff4e5e96a0cae35848ac6f11cba84ef56327e4f1531"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-hYM1tl3rMYx+qyLyBVdSi/2ukM2FZuiV06y6AEc51M8iPUeEiJgvuYWepb6j35oCO75foXkwxm1iWuQBFAnH+Q==",
                "sha1": "e7f80cec8de6eb6175717bd96cb5c1fec46ef22b"
            },
            "filename": "vue-0.4.1.tgz"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@syncraft-labs/vue/MAL-2026-14369.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]