MAL-2026-4783

    Dashboard / Malicious Package / MAL-2026-4783

    MAL-2026-4783

    Published: 26 May 2026Last Modified: 27 May 2026

    Summary: Malicious code in @iola_adm/iola-cli (npm)

    Details: Source: amazon-inspector (6e28a7ca88c4000d6efee1c0e324c8f28bebf03ef988e2ac3aa437857f34ee08) src/cli.js contains a hardcoded endpoint https://apiiola.yasg.ru referenced multiple times (lines 1, 2, 198) and invoked via fetch() at line 256, in code paths that read process.env. The destination domain is a non-descriptive third-party host on the.ru TLD with no relationship to the package's apparent identity (@iola_adm/iola-cli) or any documented publisher infrastructure. The combination of a hardcoded foreign C2-shaped destination, fetch() calls into it, and process.env reads in the same file matches the active-attack/exfiltration shape: any installer who runs the CLI will have environment data shipped to an attacker-controlled endpoint.

    References: https://www.npmjs.com/package/@iola_adm/iola-cli/v/0.1.2

    Affected packages

    Package

    Name: @iola_adm/iola-cli

    Purl: pkg:npm/%40iola_adm%2Fiola-cli

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.1.2