MAL-2026-6708

    Dashboard / Malicious Package / MAL-2026-6708

    MAL-2026-6708

    Published: 1 Jul 2026Last Modified: 1 Jul 2026

    Summary: Malicious code in zyncmap (npm)

    Details: Source: amazon-inspector (3a65a1106fa2bab6eb0b5982b289665b4b96a6ad86769a867f6e62fb73663f77) [email protected] advertises itself as an SVG sanitization/minification utility, but index.js exports an undocumented function getPlugin() that, when invoked, performs an HTTP GET against the anonymous paste host https://www.jsonkeeper.com/b/3P9BF and passes the response's `model` string field directly to eval(). Content at that paste URL is attacker-mutable, so any consumer that calls the exported getPlugin() executes arbitrary attacker-controlled JavaScript in the installer's Node.js process. The README and ~80% of index.js implement plausible SVG helpers as cover; the remote-fetch+eval export and a misleading `bearrtoken: "logo"` header are appended separately and not mentioned in package documentation. This is a backdoor: a hidden code path giving the publisher persistent remote code execution against any consumer who reaches the export.

    References: https://www.npmjs.com/package/zyncmap/v/0.0.1, https://www.npmjs.com/package/zyncmap/v/0.0.0

    Affected packages

    Package

    Name: zyncmap

    Purl: pkg:npm/zyncmap

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.0.1
    0.0.0
    MAL-2026-6708 | CVE-DB