MAL-2026-12379

    Dashboard / Malicious Package / MAL-2026-12379

    MAL-2026-12379

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in fastify-client-bundler (npm)

    Details: Source: amazon-inspector (370379b65a0c7e31b5bf43362a0c1fa1312f9a458a7af9a4a3d95892dc2a6935) index.js (the package main) defines a getPlugin() function that fetches JSON from a hardcoded bare-IP HTTPS endpoint at 31.97.137.157:45000 and compiles the response's `credits` field via `new Function(...)` with `require`, `module`, `exports`, `process`, `Buffer`, and `Promise` injected, then invokes it — granting the remote endpoint arbitrary code execution in the Node process that loads the package. The package's declared purpose (a Fastify client bundler / Tailwindcss forms bundler) and CDN-style helpers (setDefaultModule constructing cdnjs URLs) are unused decoys; the actually-invoked network path targets the bare IP. Bundled runtime dependencies (@primno/dpapi, better-sqlite3, node-machine-id) are consistent with a Windows credential/wallet stealer that a delivered payload would load through the injected `require`.

    References: https://www.npmjs.com/package/fastify-client-bundler/v/1.4.0

    Affected packages

    Package

    Name: fastify-client-bundler

    Purl: pkg:npm/fastify-client-bundler

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.4.0
    MAL-2026-12379 | CVE-DB