MAL-2026-10098

    Dashboard / Malicious Package / MAL-2026-10098

    MAL-2026-10098

    Published: 9 Jul 2026Last Modified: 12 Jul 2026

    Summary: Malicious code in fastify-addone (npm)

    Details: Source: amazon-inspector (21b9e477cff478ab071039c18c3adb6577a07cc1d82687b9e7d7cd2594dc9ddf) The package presents itself as fastify-plugin (name fastify-addone, repository/homepage/bugs fields point at fastify/fastify-plugin) and copies that project's source with a malicious statement inserted. lib/getPluginName.js contains a top-level statement that base64-decodes a URL via atob, fetches the JSON at https://www.jsonkeeper.com/b/HDXPP, and passes the returned content field to eval. This executes attacker-controlled JavaScript in the caller's process on any require('fastify-addone') (directly or via plugin.js). The destination is an anonymous, mutable third-party JSON-hosting service — not the publisher's infrastructure — and the payload URL is hidden behind base64 to evade casual review.

    References: https://www.npmjs.com/package/fastify-addone/v/5.1.0, https://www.npmjs.com/package/fastify-addone/v/5.1.1

    Affected packages

    Package

    Name: fastify-addone

    Purl: pkg:npm/fastify-addone

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    5.1.0
    5.1.1
    MAL-2026-10098 | CVE-DB