MAL-2026-14346

    Dashboard / Malicious Package / MAL-2026-14346

    MAL-2026-14346

    Published: 21 Aug 2026Last Modified: 21 Aug 2026

    Summary: Malicious code in @next-fonts/font (npm)

    Details: Source: amazon-inspector (4e536e77176d5fb4637105c50280763e82a6a273dd7de35bb82da340b0f71163) @next-fonts/font is a typosquat of Next.js's @next/font. Its exported Inter() function (mimicking next/font/google) decodes a base64 blob via atob(), then executes it through spawn('node','-e', code) with an eval(code) fallback. The decoded payload uses on-chain data as a C2 channel: it queries api.trongrid.io or fullnode.mainnet.aptoslabs.com for a transaction tied to hardcoded wallet addresses, retrieves that transaction's input data from BSC RPC endpoints (bsc-dataseed.binance.org, bsc-rpc.publicnode.com) via eth_getTransactionByHash, XOR-decrypts the returned bytes, and evals the resulting JavaScript. The result is arbitrary attacker-controlled code execution on any Node process that imports the package and invokes Inter(), with no relation to font functionality. Obfuscation (base64-hidden payload, node -e detached spawn with eval fallback, blockchain-mediated fetch) conceals the downloader from casual inspection.

    References: https://www.npmjs.com/package/@next-fonts/font/v/1.0.1, https://www.npmjs.com/package/@next-fonts/font/v/1.0.0

    Affected packages

    Package

    Name: @next-fonts/font

    Purl: pkg:npm/%40next-fonts/font

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.1
    1.0.0