MAL-2026-16277

    Dashboard / Malicious Package / MAL-2026-16277

    MAL-2026-16277

    Published: 18 Sept 2026Last Modified: 18 Sept 2026

    Summary: Malicious code in xa424234657567 (npm)

    Details: Source: amazon-inspector (0174148efc99cd1130b3b9f2c57599aac0f80ead454fd7dc0f397386db891b0c) The package ships console.js, which when loaded in a browser on any host matching duel.com fetches https://unpkg.com/[email protected]/1.js and https://unpkg.com/[email protected]/ui.js and executes both via (0, eval)(...). On other hosts it redirects the page to duel.com. The declared main/unpkg entry 1.js is a ~740KB single-line Function("ZU7mhwD", "...") loader built from hex-escaped char arrays and a rotor-style decoder, with no readable source. Package metadata is placeholder-quality (name xa424234657567, no README, no repository), inconsistent with a library and consistent with a payload-delivery artifact. Consuming this package on a page served under duel.com results in remote, mutable, attacker-controlled code executing in the page context.

    References: https://www.npmjs.com/package/xa424234657567/v/1.0.0

    Affected packages

    Package

    Name: xa424234657567

    Purl: pkg:npm/xa424234657567

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0