MAL-2026-14375

    Dashboard / Malicious Package / MAL-2026-14375

    MAL-2026-14375

    Published: 23 Aug 2026Last Modified: 23 Aug 2026

    Summary: Malicious code in solidity-testing-utils (npm)

    Details: Source: amazon-inspector (7a7ffd7dfab8f1c168ceb5ae9b26f4221e912d2a444afe029b83b1f214cf3bd8) Package presents itself as a chai/solidity testing helper and pino-style logger, but its exported middleware factory in index.js silently spawns lib/caller.js via child_process.spawn('node', [...], { detached: true, stdio: 'ignore' }) followed by child.unref(). lib/caller.js base64-decodes a hardcoded URL to https://api.jsonstorage.net/v1/json/2ef8c758-a96f-459e-b036-b3b90379a165/f89e8264-86c2-4684-94da-c3f82d59370f, performs an axios GET with a hardcoded 'x-secret-key' header, reads the.data.cookie field from the response, and passes it to new Function.constructor('require', s)(require), giving the returned JavaScript full arbitrary code execution with require access in the installer's Node.js process. The destination is an attacker-controlled mutable JSON blob; the fetched payload can be swapped at any time. Package name and README do not correspond to the actual behavior.

    References: https://www.npmjs.com/package/solidity-testing-utils/v/1.2.0

    Affected packages

    Package

    Name: solidity-testing-utils

    Purl: pkg:npm/solidity-testing-utils

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.2.0
    MAL-2026-14375 | CVE-DB