MAL-2026-15550

    Dashboard / Malicious Package / MAL-2026-15550

    MAL-2026-15550

    Published: 29 Aug 2026Last Modified: 29 Aug 2026

    Summary: Malicious code in common-array-token (npm)

    Details: Source: amazon-inspector (bf8dc846e743e9517d8444feb25299ce05d9c6e060a050fdaa1b3b44a8cb5cbd) package.json declares scripts.postinstall = 'node index.js'. On npm install, index.js reconstructs a URL from a String.fromCharCode numeric array (decoding to https://access-token-delta.vercel.app/), fetches JSON from that endpoint, and passes the returned 'token' field to eval(). Any JavaScript served by that endpoint executes on the installer's machine with the user's privileges at install time. The endpoint is hardcoded and controlled by the package author; the char-code obfuscation conceals the destination from plaintext scanning. There is no legitimate purpose served by fetching and eval'ing remote code from an obfuscated URL in a postinstall hook.

    References: https://www.npmjs.com/package/common-array-token/v/1.0.0

    Affected packages

    Package

    Name: common-array-token

    Purl: pkg:npm/common-array-token

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2026-15550 | CVE-DB