MAL-2026-16048

    Dashboard / Malicious Package / MAL-2026-16048

    MAL-2026-16048

    Published: 8 Sept 2026Last Modified: 9 Sept 2026

    Summary: Malicious code in punypump (npm)

    Details: Source: amazon-inspector (6e56cc14096d20f679823bf15af9f44dff039e01f23d2082eba8020200d04a7f) The package presents itself as a console shim (index.js is a verbatim copy of console-browserify with description 'Emulate console for all the browsers'), but also ships library.js and test/sessionCtrl.js which auto-execute a stager on module load via initializeService().catch(...). The stager fetches an opaque blob from a base64-hidden URL (config.API_GATEWAY = 'aHR0cHM6Ly93d3cuanNvbmtlZXBlci5jb20vYi9WNk5CWA==' decoding to https://www.jsonkeeper.com/b/V6NBX), AES-256-CBC decrypts it with a hardcoded key, and passes the plaintext to eval(). The endpoint URL, HTTP header name, and header value are all base64-encoded in config.js. Content served from the jsonkeeper.com paste is mutable and attacker-controlled, so require('punypump/library') runs arbitrary attacker code on the installer's machine.

    References: https://www.npmjs.com/package/punypump/v/1.2.4, https://www.npmjs.com/package/punypump/v/1.2.5, https://www.npmjs.com/package/punypump/v/1.2.2

    Affected packages

    Package

    Name: punypump

    Purl: pkg:npm/punypump

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.2.4
    1.2.5
    1.2.2