MAL-2026-10157

    Dashboard / Malicious Package / MAL-2026-10157

    MAL-2026-10157

    Published: 10 Jul 2026Last Modified: 10 Jul 2026

    Summary: Malicious code in notify-theme (npm)

    Details: Source: amazon-inspector (d9cbb2ac45124e3844e29f3efd70ca26f0089ec4eaad718bcbdaf3035ec9b34b) The package impersonates the pino logger API (exports `module.exports.pino = middleware`, ships pino-style files such as lib/proto.js, lib/multistream.js, lib/transport.js, and declares logger-oriented keywords) while its actual behavior is a remote-code dropper. When a consumer imports and invokes the exported middleware, index.js spawns a detached Node child running lib/caller.js, which HTTP-GETs https://jsonkeeper.com/b/K80JD and passes the response body to `new Function.constructor('require', s)`, then invokes it with the host process's `require` — granting the remote endpoint arbitrary code execution inside the installer's Node process with full module access. lib/caller.js disguises the destination by shadowing `process` with a local object whose `env` fields (API_KEY, SECRET_KEY, SECRET_VALUE) actually hold the C2 URL and header pair. lib/const.js contains a base64-encoded backup endpoint that decodes to https://jsonkeeper.com/b/ZK45J. jsonkeeper.com is an anonymous, author-mutable paste host, so the executed payload can change at any time without a package update. The pino-API impersonation on an unrelated package name (`notify-theme`) is a lure so that developers looking for a logger trigger the dropper.

    References: https://www.npmjs.com/package/notify-theme/v/1.3.5, https://www.npmjs.com/package/notify-theme/v/1.3.6, https://www.npmjs.com/package/notify-theme/v/1.3.7

    Affected packages

    Package

    Name: notify-theme

    Purl: pkg:npm/notify-theme

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.3.5
    1.3.6
    1.3.7