MAL-2026-14264

    Dashboard / Malicious Package / MAL-2026-14264

    MAL-2026-14264

    Published: 19 Aug 2026Last Modified: 19 Aug 2026

    Summary: Malicious code in de-morgan (npm)

    Details: Source: amazon-inspector (93cdcef4435e4bbb8f5841076c9294b934eaebd268286204a37cab9c334a045f) package.json declares both a `dependencies` and `devDependencies` entry for `de-morgan` pointing at `http://pack.nppacks.com/npm/de-morgan`, a non-npm-registry host reached over plain HTTP with no version pin or integrity check. On `npm install`, npm fetches and installs whatever tarball is served from that URL into the dependency graph, executing any lifecycle scripts it contains. The visible index.js is a clone of babel-plugin-transform-define and carries a top-of-file comment stating `This package use for Security Research Testing Purpose.`, but the shipped manifest wires in an attacker-controlled, mutable, plaintext delivery URL under a lookalike domain (`nppacks.com`), so the installed code path is whatever the remote host currently serves rather than the benign in-tree source.

    References: https://www.npmjs.com/package/de-morgan/v/2.1.3

    Affected packages

    Package

    Name: de-morgan

    Purl: pkg:npm/de-morgan

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.1.3
    MAL-2026-14264 | CVE-DB