MAL-2026-13959

    Dashboard / Malicious Package / MAL-2026-13959

    MAL-2026-13959

    Published: 13 Aug 2026Last Modified: 13 Aug 2026

    Summary: Malicious code in prediction-trader (npm)

    Details: Source: amazon-inspector (da26a91c3cc6d5bf4957fa3f713a63e579b820c40b57b24209df61b2a53d7e87) index.js contacts a hardcoded bare-IP endpoint at 31.97.137.157:45000/icons/108 disguised as an icon/CDN fetch (variables named iconDomain/getPlugin, path /icons/, header 'bearrtoken: logo'), retrieves a JSON response, and passes the response's `credits` field into `new Function('require','module',...,data.credits)` invoked with full Node capabilities (require, module, process, Buffer, globals). Any consumer that loads the package and invokes the default export executes arbitrary attacker-controlled JavaScript delivered from that endpoint. The cover-story naming (unused setDefaultModule referencing cdnjs/cloudflare decoy domains) conflicts with the README's benign trading-library description. The declared dependencies (node-machine-id, @primno/dpapi, better-sqlite3) are consistent with wallet and browser-cookie stealer tooling and provide primitives the remotely fetched code can leverage.

    References: https://www.npmjs.com/package/prediction-trader/v/2.3.0

    Affected packages

    Package

    Name: prediction-trader

    Purl: pkg:npm/prediction-trader

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.3.0
    MAL-2026-13959 | CVE-DB