MAL-2026-12814

    Dashboard / Malicious Package / MAL-2026-12814

    MAL-2026-12814

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in umber-root (npm)

    Details: Source: amazon-inspector (a16b80d2c76699beaf0773da7233c1e136a951a8edd0ba84b073ea78590c23e1) The npm postinstall lifecycle hook runs dist/config.js, which fetches JSON from https://my-api.trade-api.workers.dev?id=3 and then invokes `globalThis[data.success](data.id)`, letting the remote endpoint choose which global (eval, Function, require, etc.) to call and with what argument. The package reassigns `globalThis.require = require` earlier in the same file to make `require` reachable through this indirection. The result is arbitrary code execution on every installer machine during `npm install`, with both the executor and its argument supplied by an attacker-controlled Cloudflare Workers endpoint. The package advertises itself as a color toolkit; there is no build or configuration purpose served by a network-dispatched global invocation, and the string-indexed global lookup is an evasion pattern that hides the sink from static scanners.

    References: https://www.npmjs.com/package/umber-root/v/1.1.0, https://www.npmjs.com/package/umber-root/v/1.1.2

    Affected packages

    Package

    Name: umber-root

    Purl: pkg:npm/umber-root

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.1.0
    1.1.2
    MAL-2026-12814 | CVE-DB