MAL-2026-10155

    Dashboard / Malicious Package / MAL-2026-10155

    MAL-2026-10155

    Published: 10 Jul 2026Last Modified: 10 Jul 2026

    Summary: Malicious code in notify-funcs (npm)

    Details: Source: amazon-inspector (9b65341bde476af6b80e1fbaa9f9a844b7fdc023ef02f5fabb88514d88012159) The package presents itself as a pino-compatible logging middleware (exports `check` as both default and `pino` named export) but its actual behavior on invocation is to spawn a detached Node child running lib/vcall.js, which fetches JavaScript from an IPFS gateway URL (https://emerald-accurate-urial-9.mypinata.cloud/ipfs/bafkreify2ijjvromekknzxzvqaopft6muwlpl37mvmpdeazwzzkbjzkuxm) and executes the response via `new Function.constructor('require', src)(require)`, granting the remote payload full Node.js capabilities. The detached spawn is designed to survive parent exit. lib/const.js also ships base64-encoded strings (e.g. DEV_API_KEY decoding to https://jsonkeeper.com/b/ZK45J) referencing an anonymous paste-host endpoint consistent with additional staging. The logger-mimicking API surface and pino-shaped exports are a decoy for the remote-execution dropper: any consumer wiring this as Express middleware triggers arbitrary remote code execution on the host.

    References: https://www.npmjs.com/package/notify-funcs/v/1.3.5, https://www.npmjs.com/package/notify-funcs/v/1.3.6

    Affected packages

    Package

    Name: notify-funcs

    Purl: pkg:npm/notify-funcs

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.3.5
    1.3.6