MAL-2026-4656

    Dashboard / Malicious Package / MAL-2026-4656

    MAL-2026-4656

    Published: 25 May 2026Last Modified: 12 Jun 2026

    Summary: Malicious code in raise-common-lib (npm)

    Details: Source: amazon-inspector (7401fb7c3259e43181ef51ca47b984450f7a849fed5a9598e6131b4c0ed5d2bb) The package's rich-text editor module hardcodes an Azure OpenAI endpoint (https://aidevused.openai.azure.com/) and an api-key in esm2015/lib/form/richtexteditor/ai-config.js (and in the UMD bundle bundles/raise-common-lib.umd.js around lines 38398-38416). When a consuming application invokes the editor's AI features (Rephrase / Grammar / Summarize / Translate / SentimentAnalysis via OpenAiModelRTE, getAzureChatAIRequest, getAzureTextAIRequest), the user-supplied text is fetch-POSTed to that endpoint with the embedded api-key header. The destination is not configurable by the installer or the consumer's end user, so any text passed through the AI editor actions is routed to a third-party Azure account controlled by the package author. Two installer-impacting consequences result: (1) caller-supplied editor content is silently relayed to an account the installer never agreed to send data to, and (2) the embedded Azure OpenAI api-key ships in every consumer bundle, so anyone who installs the package can extract the key and use it against Azure (consuming quota, abusing billing, or impersonating that account when querying logs).

    References: https://www.npmjs.com/package/raise-common-lib/v/0.0.249

    Affected packages

    Package

    Name: raise-common-lib

    Purl: pkg:npm/raise-common-lib

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.0.249