MAL-2026-14043

    Dashboard / Malicious Package / MAL-2026-14043

    MAL-2026-14043

    Published: 14 Aug 2026Last Modified: 14 Aug 2026

    Summary: Malicious code in @divineubg/divine (npm)

    Details: Source: amazon-inspector (52dc0a48d6e7e18ff3bb09306aa6d4c17aefff323b1f86b84f19197ba4a094be) index.js exports a listen(clientId) function that subscribes to https://ntfy.sh/dv-141u30-admin-cmd-<clientId>/sse via EventSource and, on receiving messages with action 'EVAL_CODE', passes the message payload to eval() and new Function() — executing attacker-supplied JavaScript in the loading context. Execution results are POSTed back to https://ntfy.sh/dv-141u30-admin-status-<clientId>. The clientId is a 7-digit value persisted in localStorage as g_live_username. Any application bundling this package ships a remote command-and-control channel to end-user browsers: whoever knows or enumerates a client's topic can run arbitrary JavaScript in that browser and receive the results, with no integrity check, origin restriction, or user confirmation.

    References: https://www.npmjs.com/package/@divineubg/divine/v/1.0.5

    Affected packages

    Package

    Name: @divineubg/divine

    Purl: pkg:npm/%40divineubg/divine

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.5
    MAL-2026-14043 | CVE-DB