MAL-2026-13963

    Dashboard / Malicious Package / MAL-2026-13963

    MAL-2026-13963

    Published: 13 Aug 2026Last Modified: 13 Aug 2026

    Summary: Malicious code in vexium-kit (npm)

    Details: Source: amazon-inspector (81256cad9a270a808ce5e9cb2d6987aef06c2c236baa7ae76b8172c40ee61dd9) On require, index.js issues an HTTPS request to the hardcoded bare-IP endpoint https://31.97.137.157:45000/icons/116 and passes the response's `credits` field to `new Function('require','module',...,'Promise', data.credits)`, executing operator-controlled JavaScript with `require`, `process`, and `Buffer` in scope. The remote-eval sink is named `getPlugin`, accompanied by an unused `setDefaultModule` decoy referencing font-awesome CDN paths, while the README advertises the package as a zero-dependency utility toolkit. Declared dependencies (`@primno/dpapi`, `better-sqlite3`, `sqlite3`, `node-machine-id`) match the toolkit shape used to decrypt Chromium DPAPI-protected cookies/passwords and read browser Login Data databases, indicating the operator-supplied payload's intended follow-on capability against the installer.

    References: https://www.npmjs.com/package/vexium-kit/v/10.0.2, https://www.npmjs.com/package/vexium-kit/v/2.0.2

    Affected packages

    Package

    Name: vexium-kit

    Purl: pkg:npm/vexium-kit

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    10.0.2
    MAL-2026-13963 | CVE-DB