MAL-2026-1318

    Dashboard / Malicious Package / MAL-2026-1318

    MAL-2026-1318

    Published: 10 Mar 2026Last Modified: 23 Mar 2026

    Summary: Malicious code in @web-monorepo/fetchers (npm)

    Details: Package is malware. It exfiltrates data to a suspicious domain via callback.js, triggered by a preinstall script in package.json. Source: amazon-inspector (a3faaa666cb666785670b3a638b1f832d4492f7eb2c999f41f7bb551cde2aa86) The package @web-monorepo/fetchers was found to contain malicious code.

    References: https://app.safedep.io/community/malysis/01KK3ARTMK1RXWTT6A7T2KTKER

    Affected packages

    Package

    Name: @web-monorepo/fetchers

    Purl: pkg:npm/%40web-monorepo/fetchers

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -None

    Affected versions