MAL-2026-4419

    Dashboard / Malicious Package / MAL-2026-4419

    MAL-2026-4419

    Published: 25 May 2026Last Modified: 27 May 2026

    Summary: Malicious code in @pmate/utils (npm)

    Details: Source: amazon-inspector (d918da5fdc17486ed55296e53c1de2f1d976895f77e33dc7f73991e36f393502) The exported `detectText(imageBase64)` function in src/detectText.ts sends caller-supplied image content to https://vision.googleapis.com/v1/images:annotate using a hardcoded Google Cloud API key (`AIzaSyB60IT_Mte2tZisNiBujfS_q9MPOnw6tgk`) belonging to the package author. Any consumer who calls the advertised text-detection utility unknowingly routes their image data through the author's Google Cloud project, where requests are quota-tracked and may be logged on the author's side. Callers cannot configure or disable this destination — it is hardcoded in the function body. The hardcoded key is also distributed in plaintext to every installer, allowing anyone to drain the author's Vision API quota.

    References: https://www.npmjs.com/package/@pmate/utils/v/1.1.4

    Affected packages

    Package

    Name: @pmate/utils

    Purl: pkg:npm/%40pmate%2Futils

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.1.4
    MAL-2026-4419 | CVE-DB