MAL-2026-16053

    Dashboard / Malicious Package / MAL-2026-16053

    MAL-2026-16053

    Published: 9 Sept 2026Last Modified: 9 Sept 2026

    Summary: Malicious code in file-type-detector (npm)

    Details: Source: amazon-inspector (04917bd7fc156dcb9793cb1f1d06ed0f2d0cb1b3aa4b04431dea54ed71f6be72) A clone of file-type-checker with one function added: isSign(name, moduleName, offset) in dist/validation/image.js reads public/${name}.png from the working directory, splits the buffer at -offset, and writes the trailing payload to../../../{moduleName}/log - a sibling package under node_modules - then returns isPNG() so the caller sees a plausible boolean. It is undocumented, reachable only via an __exportStar wildcard so it is never named in dist/index.js, and fails silently on try/catch. Drop stage of a three-package chain: file-type-detector writes the payload, gloggo (1.1.2-1.1.4) executes it via require('./log'), and sonmors (typosquat of sonner) triggers the chain by requiring gloggo. gloggo shares the npm publisher log-developer and was published five minutes apart on 2026-08-27. No install hooks; execution occurs on require().

    References: https://www.npmjs.com/package/file-type-detector/v/1.1.0, https://www.npmjs.com/package/file-type-detector/v/1.1.1

    Affected packages

    Package

    Name: file-type-detector

    Purl: pkg:npm/file-type-detector

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.1.0
    1.1.1