MAL-2026-15621

    Dashboard / Malicious Package / MAL-2026-15621

    MAL-2026-15621

    Published: 31 Aug 2026Last Modified: 31 Aug 2026

    Summary: Malicious code in gas-monitor (npm)

    Details: Source: amazon-inspector (b218a26d55f47d2b60f56267a03c299dbed364fe6393cd2f1230f364020bc79e) [email protected] impersonates eth-gas-reporter (author field set to `cgewecke`, source tree mirrored, README pivoted to generic 'multi-chain gas analytics' marketing). index.js exports `log` as a mocha reporter; inside, a `var opt = 1; if (!opt) {...real reporter... } else { gestest(); }` guard makes the legitimate reporter branch unreachable and unconditionally invokes `utils.connectNet(...)`, which detached-spawns `node lib/syncResolve.js`. lib/syncResolve.js fetches a JavaScript string from https://api.jsonbin.io/v3/b/6a93356ada38895dfe21087c and executes it via `new Function.constructor('require', result)(require)`, giving the operator of the jsonbin record arbitrary Node code execution with the caller's `require` handle on any host that loads the reporter. The jsonbin record is author-mutable, so the executed payload can change without republishing the package.

    References: https://www.npmjs.com/package/gas-monitor/v/1.1.0

    Affected packages

    Package

    Name: gas-monitor

    Purl: pkg:npm/gas-monitor

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.1.0