MAL-2026-14225

    Dashboard / Malicious Package / MAL-2026-14225

    MAL-2026-14225

    Published: 19 Aug 2026Last Modified: 19 Aug 2026

    Summary: Malicious code in ambera (npm)

    Details: Source: amazon-inspector (d24544221570c21c3b710d7c4d39ed76e7cc8b43a555bb7c8e6fefa78aa3f625) The package presents itself as a zero-dependency SVG helper, but its exported getPlugin() function performs an HTTPS GET to the hardcoded host https://api.avax-test.dev/ext/bc/rpc with TLS verification disabled (rejectUnauthorized: false) and passes the response body directly to new Function('require', data)(require). Any caller of getPlugin() executes whatever JavaScript the remote host returns, with the Node require function injected — effectively arbitrary remote code execution on the caller's machine. The destination host api.avax-test.dev is a lookalike of the legitimate Avalanche Fuji RPC endpoint api.avax-test.network, and the Avalanche/Snowtrace variable naming is cover-story labeling: the package's stated SVG purpose has no network or blockchain functionality. Combined with the disabled TLS verification, this is a deliberately concealed remote-exec channel embedded in an unrelated utility.

    References: https://www.npmjs.com/package/ambera/v/1.0.0, https://www.npmjs.com/package/ambera/v/1.0.1

    Affected packages

    Package

    Name: ambera

    Purl: pkg:npm/ambera

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    1.0.1