MAL-2026-14375

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/solidity-testing-utils/MAL-2026-14375.json
JSON Data
https://api.test.osv.dev/v1/vulns/MAL-2026-14375
Published
2026-08-23T03:14:19Z
Modified
2026-08-23T03:30:17.343903844Z
Summary
Malicious code in solidity-testing-utils (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (7a7ffd7dfab8f1c168ceb5ae9b26f4221e912d2a444afe029b83b1f214cf3bd8)

Package presents itself as a chai/solidity testing helper and pino-style logger, but its exported middleware factory in index.js silently spawns lib/caller.js via child_process.spawn('node', [...], { detached: true, stdio: 'ignore' }) followed by child.unref(). lib/caller.js base64-decodes a hardcoded URL to https://api.jsonstorage.net/v1/json/2ef8c758-a96f-459e-b036-b3b90379a165/f89e8264-86c2-4684-94da-c3f82d59370f, performs an axios GET with a hardcoded 'x-secret-key' header, reads the.data.cookie field from the response, and passes it to new Function.constructor('require', s)(require), giving the returned JavaScript full arbitrary code execution with require access in the installer's Node.js process. The destination is an attacker-controlled mutable JSON blob; the fetched payload can be swapped at any time. Package name and README do not correspond to the actual behavior.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-018567",
            "sha256": "7a7ffd7dfab8f1c168ceb5ae9b26f4221e912d2a444afe029b83b1f214cf3bd8",
            "modified_time": "2026-08-23T03:14:19Z",
            "versions": [
                "1.2.0"
            ],
            "import_time": "2026-08-23T03:25:56.015182577Z",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / solidity-testing-utils

Package

Name
solidity-testing-utils
View open source insights on deps.dev
Purl
pkg:npm/solidity-testing-utils

Affected ranges

Affected versions

1.*
1.2.0

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "ffa61701ff61ebc0c6d64cf09f5bc37a74a91b03b716129b90271d758dc164b7",
            "path": "lib/caller.js",
            "tlsh": "6e01efd934fd501c021111ea171fa032a010e4373882d6c8374cc7428fa66bd2e93aef"
        },
        {
            "sha256": "2956b023858d706a5e241cd28b845088e5f414c5f70bd5d8cb73cb427d081065",
            "path": "index.js",
            "tlsh": "5d213c81b9f11188065cd9c8b569e53a38e3c4377207b9b0e9ec87862bcf2080272ad7"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-nDVJip8dzYaYWp7wz33KlQbHABIs5ixudqZF1mLkL6FFTbZIpHVo85Lli4A8GM4Ee55jvqgkWUjl76oXByBKng==",
                "sha1": "5bc41c702a22949c03e7cd4632a2d7fd2a058ccc"
            },
            "filename": "solidity-testing-utils-1.2.0.tgz"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/solidity-testing-utils/MAL-2026-14375.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]