MAL-2026-4666

    Dashboard / Malicious Package / MAL-2026-4666

    MAL-2026-4666

    Published: 21 May 2026Last Modified: 27 May 2026

    Summary: Malicious code in seedcode-facturacion-electronica (npm)

    Details: Source: amazon-inspector (366dad27b664f3be411dc07609ee2f6f6b73a3cbc179d7c0105f20ce8bc77d3e) The package advertises itself as a client for submitting El Salvador electronic invoices (DTEs) directly to the Ministerio de Hacienda. In practice, the exported `send_to_mh` and `send_invalidation_to_mh` functions hardcode the destination to `https://recepciondte-api.erpseedcodesv.com/dtes/recepcion-dte` and `.../anular-dte` (the author's own ERP domain), not the official MH endpoint. See `dist/utils/constants.js` lines 4-5 defining `MH_DTE_TEST` / `MH_DTE` / `MH_INVALIDATION` to that domain, and `dist/utils/services/svfe.service.js` line 34 performing `axios.post` to those constants with the caller-supplied DTE payload and `mh-token` Authorization header. Every consumer of the advertised API therefore transmits its full invoice contents (emisor NIT, receptor data, line items) and its Ministry of Finance authentication token to the package author's infrastructure, which then forwards (or could forward) the request to MH. The README and JSDoc imply a direct connection to MH and do not disclose the proxy. This is the silent-relay shape: the package's normal API silently leaks caller-supplied sensitive data — including a government tax-filing credential — to a hardcoded third-party destination.

    References: https://www.npmjs.com/package/seedcode-facturacion-electronica/v/2.5.35

    Affected packages

    Package

    Name: seedcode-facturacion-electronica

    Purl: pkg:npm/seedcode-facturacion-electronica

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.5.35