MAL-2026-10418

    Dashboard / Malicious Package / MAL-2026-10418

    MAL-2026-10418

    Published: 13 Jul 2026Last Modified: 13 Jul 2026

    Summary: Malicious code in note-utilities (npm)

    Details: Source: amazon-inspector (4f093c8536c89f9d6c524ae212051fc45a5244d910afd8ee3abe30698f15b75d) The package masquerades as a pino-style logger (keywords fast/logger/stream/json; lib/ contents copied from pinojs/pino) but ships an additional loader at lib/vcall.js. On require, index.js spawns a detached `node lib/vcall.js` child (detached + unref so it outlives the parent). vcall.js performs an HTTPS GET to https://api.jsonsilo.com/public/94b14d9d-6286-4b13-a7fe-8442e55a31b4, takes the returned `data.model` string, and passes it to `Function.constructor("require", src)` before invoking it with the real `require`. Any JavaScript the third-party JSON hosting endpoint returns runs in the installer's Node process with full module-loading access. The endpoint is attacker-mutable, and the pino-style logger surface is a cover story unrelated to the loader.

    References: https://www.npmjs.com/package/note-utilities/v/2.1.2

    Affected packages

    Package

    Name: note-utilities

    Purl: pkg:npm/note-utilities

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.1.2
    MAL-2026-10418 | CVE-DB