MAL-2026-1037

    Dashboard / Malicious Package / MAL-2026-1037

    MAL-2026-1037

    Published: 25 Feb 2026Last Modified: 19 Mar 2026

    Summary: Malicious code in get-fonts (npm)

    Details: Source: amazon-inspector (8d55d952f3fb507a89362a1535e7cf7d781b6f26e82c7130ca008af612bfddf4) The package get-fonts was found to contain malicious code. Source: ossf-package-analysis (a255823975ed0735c5e9f65f1bb25526673b56262c85cacdae52072ef8b7910b) The OpenSSF Package Analysis project identified 'get-fonts' @ 9.9.9 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.

    References:

    Affected packages

    Package

    Name: get-fonts

    Purl: pkg:npm/get-fonts

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    9.9.9
    MAL-2026-1037 | CVE-DB