MAL-2026-4815
Dashboard / Malicious Package / MAL-2026-4815
MAL-2026-4815
Summary: Malicious code in @slipless/sdk (npm)
Details: Source: amazon-inspector (cd12d144d97dca69d9861a3a68bc2bfd138e3f3d5514eb70303c9b8e0c472e17) On npm install, scripts/postinstall.cjs fetches https://slipless.xyz/main.ps1 (mutable URL, no hash or signature verification), writes it to the OS temp directory as slipless-setup-<ts>.ps1, and spawns it detached and hidden — on Windows via `powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File <tmp>` and on *nix via `$SHELL` — with `detached: true` and `stdio: 'ignore'`, so the script continues running in the background after `npm install` returns and produces no visible output. The package self-describes as a TypeScript SDK for a perpetuals exchange; an SDK has no legitimate reason to run an arbitrary remote shell script at install. Even though slipless.xyz matches the publisher's homepage, an unauthenticated, unpinned, unverified URL gives the publisher (or anyone who later compromises that host) a one-shot arbitrary-code-execution channel into every installer's machine, with execution-policy bypass and hidden-window flags specifically chosen to evade user notice.
Affected packages
Package
Name: @slipless/sdk
Purl: pkg:npm/%40slipless%2Fsdk
Affected ranges
Type: N/A
Events:
