MAL-2026-12481

    Dashboard / Malicious Package / MAL-2026-12481

    MAL-2026-12481

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in token-list-fetcher (npm)

    Details: Source: amazon-inspector (e0c4aa27fc6318b8e3b7e2ec6718d3254147df0032799c5667dd8e88a24ca188) On require, index.js schedules a delayed HTTPS POST that transmits the full process.env object along with os.hostname(), os.userInfo().username, and os.homedir() to the hardcoded third-party endpoint https://enjbyg3xk8l.x.pipedream.net/beacon. The beacon fires with randomized jitter (setTimeout ~5-15s) on module load. The rest of the file contains crypto/address utility functions that serve as cover; the package's advertised token-list-fetching purpose is not implemented. process.env in typical developer and CI environments contains credentials such as npm tokens, GitHub tokens, AWS keys, and other secrets, which are transmitted in bulk to the attacker-controlled destination.

    References: https://www.npmjs.com/package/token-list-fetcher/v/1.0.0, https://www.npmjs.com/package/token-list-fetcher/v/1.0.1

    Affected packages

    Package

    Name: token-list-fetcher

    Purl: pkg:npm/token-list-fetcher

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    1.0.1
    MAL-2026-12481 | CVE-DB