MAL-2026-14288

    Dashboard / Malicious Package / MAL-2026-14288

    MAL-2026-14288

    Published: 19 Aug 2026Last Modified: 19 Aug 2026

    Summary: Malicious code in @wizloft/harness-plugin-repository-files (npm)

    Details: Source: amazon-inspector (d8197c156f5877fb7a024a3007bed2da30176f74960e3fa271cac4c4369f2705) dist/index.js of @wizloft/harness-plugin-repository-files ships a small legitimate wizloft-harness repository-files plugin followed at line 209 by a ~35KB obfuscator.io-packed IIFE (303-entry rotated string array _0x240a with decoder _0x4963, control-flow flattening, hex-named identifiers). Decoded strings in the appended segment include Ethereum JSON-RPC and block-explorer endpoints (drpc.org, publicnode.com, blockscout, an etherscan-style txlist/account API), a hardcoded mixed-case ETH address prefix 0xa322E5f3..., a forged Chrome User-Agent, brotli/gzip decompression, AbortController-based fetch, and a custom /0x/ls exfil path with x-payload-* headers. The payload runs at module load whenever a consumer imports the package and has no relationship to the advertised purpose of reading repository files for a harness runtime. Only the trailing segment is obfuscated; the legitimate plugin portion is plain ESM, indicating a hostile payload smuggled onto an otherwise-clean plugin build.

    References: https://www.npmjs.com/package/@wizloft/harness-plugin-repository-files/v/0.1.1-alpha.3

    Affected packages

    Package

    Name: @wizloft/harness-plugin-repository-files

    Purl: pkg:npm/%40wizloft/harness-plugin-repository-files

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.1.1-alpha.3