MAL-2026-12805

    Dashboard / Malicious Package / MAL-2026-12805

    MAL-2026-12805

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in strath (npm)

    Details: Source: amazon-inspector (b9ae02b92920c1e028b5785e69013ea4662e4eb3180872531d64ccca00eef239) The package declares a postinstall script that runs dist/config.js. That script fetches JSON from https://my-api.trade-api.workers.dev?id=2 and then executes `globalThis[data.success](data.id)`, where both the method name and its argument are supplied by the remote server. This gives the operator of that endpoint arbitrary code execution on any machine that runs `npm install strath` — the invocation fires automatically as part of the default install lifecycle. The behavior is unrelated to the package's advertised path-utility purpose. The same script also references `globalThis[tag](text)` with undefined identifiers, consistent with a deliberately opaque dropper shape rather than a normal build step.

    References: https://www.npmjs.com/package/strath/v/1.1.1, https://www.npmjs.com/package/strath/v/1.1.0

    Affected packages

    Package

    Name: strath

    Purl: pkg:npm/strath

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.1.1
    1.1.0
    MAL-2026-12805 | CVE-DB