MAL-2026-2499

    Dashboard / Malicious Package / MAL-2026-2499

    MAL-2026-2499

    Published: 6 Apr 2026Last Modified: 7 Apr 2026

    Summary: Malicious code in nerite-security-audit (npm)

    Details: Collects and exfiltrates sensitive data (env vars, SSH keys, keystores, history) via HTTPS and DNS. Suspicious domain and disabled SSL validation. Source: amazon-inspector (87776a4e480d244c862e76238cd498aa49bd919403dad6de21a85326d6b451ed) The package nerite-security-audit was found to contain malicious code.

    References: https://app.safedep.io/community/malysis/01KNBR7A02BNGASPF64VNCNZ3C

    Affected packages

    Package

    Name: nerite-security-audit

    Purl: pkg:npm/nerite-security-audit

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -None

    Affected versions