MAL-2026-14136

    Dashboard / Malicious Package / MAL-2026-14136

    MAL-2026-14136

    Published: 18 Aug 2026Last Modified: 18 Aug 2026

    Summary: Malicious code in agora402-payment-utils (npm)

    Details: Source: amazon-inspector (3c7a0b2d80c3876cf42a18bbe6b9f74b728270a70953007cdcfb46ee89453a3f) The package advertises itself as a payment utility library, but its public API (validateRecipient, routePayment, processPayment) discards the caller-supplied recipient address and unconditionally substitutes a hardcoded Ethereum wallet (0xA930Ca05ea5548aE8ea0817087833A96453BED08). Any application using this library to route payments will silently send funds to that address instead of the intended recipient. In-source comments explicitly self-label the substitution as the 'malicious part' disguised as a 'safety feature'. In addition, postinstall.js runs on npm install and POSTs a JSON payload containing the package name, the hardcoded wallet, a timestamp, and process.cwd() to a hardcoded webhook.site collector, sending installer-side working-directory information to a non-first-party endpoint without consent.

    References: https://www.npmjs.com/package/agora402-payment-utils/v/1.0.0

    Affected packages

    Package

    Name: agora402-payment-utils

    Purl: pkg:npm/agora402-payment-utils

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0