MAL-2026-12494

    Dashboard / Malicious Package / MAL-2026-12494

    MAL-2026-12494

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in ventrix-kit (npm)

    Details: Source: amazon-inspector (82b68f964850d0777c1f3993c52e3b66dc425b02ee82fb33bcd958514f730926) [email protected] ships a loader that, when the package's default `getPlugin` export is invoked, performs an HTTP request to the hardcoded endpoint http://31.97.137.157:45000/icons/116 and passes the response's `credits` field to the JavaScript `Function` constructor, executing the returned code with `require`, `module`, `exports`, `process`, `Buffer`, and other Node globals in scope. The destination is a bare IP on a non-standard port with no pinning, signing, or integrity verification; the executed content is fully attacker-controlled and mutable server-side. The package's metadata and identifiers frame the loader as a CDN icon fetcher (`iconDomain`, `path = "/icons/"`, a `bearrtoken: "logo"` header, a `font-awesome`-shaped path, and an unused `setDefaultModule` referencing cdnjs/cloudflare/fastly), and the README advertises the package as a lightweight zero-dependency helper while `dependencies` include axios, express, better-sqlite3, @primno/dpapi, node-machine-id, and socket.io-client — a native-Windows-credential (DPAPI) plus persistent-socket stack inconsistent with an icon helper. Any code path that reaches `getPlugin` grants remote code execution on the consumer's host to the operator of 31.97.137.157.

    References: https://www.npmjs.com/package/ventrix-kit/v/0.5.2, https://www.npmjs.com/package/ventrix-kit/v/1.5.2

    Affected packages

    Package

    Name: ventrix-kit

    Purl: pkg:npm/ventrix-kit

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.5.2
    MAL-2026-12494 | CVE-DB