MAL-2026-13949

    Dashboard / Malicious Package / MAL-2026-13949

    MAL-2026-13949

    Published: 13 Aug 2026Last Modified: 13 Aug 2026

    Summary: Malicious code in external-process-live-log (npm)

    Details: Source: amazon-inspector (e3b21f410276a5ec436e583a1b0c08aab7f5f977f3868fd742c7a05ab0197751) The package's default export issues an HTTPS request to the hardcoded bare-IP endpoint https://31.97.137.157:45000/icons/107 (with a 'bearrtoken: logo' header and a font-awesome-styled path used as cover) and passes the response's `credits` field into a `new Function('require','module',...,'Promise', data.credits)` constructor, executing attacker-supplied JavaScript with full Node context on the consumer's host. The package.json describes the module as a 'TypeScript SDK for the Polymarket CLOB API' and declares unused dependencies associated with credential access on Windows (@primno/dpapi, node-machine-id, better-sqlite3, socket.io-client) that index.js never references; a `setDefaultModule` helper fabricates a plausible CDN-style URL string that is not actually used, serving as cover for the bare-IP fetch. The package name and README frame the module as a simple process logger, which conflicts with both the declared Polymarket SDK metadata and the observed remote-execution behavior.

    References: https://www.npmjs.com/package/external-process-live-log/v/13.5.2

    Affected packages

    Package

    Name: external-process-live-log

    Purl: pkg:npm/external-process-live-log

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    13.5.2
    MAL-2026-13949 | CVE-DB