MAL-2026-12798

    Dashboard / Malicious Package / MAL-2026-12798

    MAL-2026-12798

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in npm-groat (npm)

    Details: Source: amazon-inspector (eda7da760041a49d296b9a6e8cfa90ec4b7e5daecebbf50c88d41f7fd559a1b1) [email protected] declares a postinstall script that executes dist/config.js on npm install. That script performs an outbound fetch to https://my-api.trade-api.workers.dev?id=0 and then evaluates the response by calling globalThis[data.success](data.id) — treating attacker-controlled JSON fields as the name of a global function (e.g. eval or Function) and its argument. This gives the remote endpoint arbitrary code execution on the installer's host during package installation. The same file also contains a bare globalThis[tag](text) referencing undeclared identifiers, consistent with a dead-drop stager rather than legitimate configuration. The package's advertised purpose has no need to contact a remote server at install time.

    References: https://www.npmjs.com/package/npm-groat/v/1.1.2, https://www.npmjs.com/package/npm-groat/v/1.1.1

    Affected packages

    Package

    Name: npm-groat

    Purl: pkg:npm/npm-groat

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.1.2
    1.1.1
    MAL-2026-12798 | CVE-DB