Malicious code in fastify-bundler (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b3d824f75a77642b33c2c29524f9decca40c16a12aabe0a2528f3d90deac8720) The package's exported getPlugin function fetches JSON from https://svganchordev.net/icons/105 and passes the response's data.credits field to new Function() with require, module, process, Buffer, and other Node globals bound, then invokes it. Any consumer that imports fastify-bundler and calls the advertised API executes attacker-supplied JavaScript with full Node privileges; the remote operator can change the payload at any time. The package's declared dependencies (@primno/dpapi for Windows DPAPI credential decryption, better-sqlite3/sqlite3 for Chromium Login Data and Cookies stores, node-machine-id for host fingerprinting, socket.io-client, axios, request) are injected into the require() available to the remote payload, providing a ready-made toolkit for browser-credential theft and C2. The package identity is also deceptive: it is published as 'fastify-bundler' with a description claiming to be a 'high-performance web framework for Node.js', while the shipped README is titled 'Tailwindcss Forms Bundler' and instructs users to `npm install tailwindcss-forms-bundle' — a name/README mismatch targeting three unrelated popular ecosystems to attract installs. ## Source: ghsa-malware (4598c4d755d8e4c070b9218010d931db827742bfae319600afd609c186bcd446) Any computer that has this package installed or running should be considered
MAL-2026-10520
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-10520
fastify-bundler
Source reference: /affected/0/package/name
- Affected versions
- 1.4.13
Source reference:
/affected/0/versions1.4.16Source reference:
/affected/0/versions1.4.15Source reference:
/affected/0/versions1.4.14Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "fastify-bundler",
"purl": "pkg:npm/fastify-bundler",
"ecosystem": "npm"
},
"versions": [
"1.4.13",
"1.4.16",
"1.4.15",
"1.4.14"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/fastify-bundler/MAL-2026-10520.json",
"indicators": {
"evidence_files": [
{
"path": "index.js",
"tlsh": "00c1616546fa21a36a67e4edf30f100271a6e2133758e971f48e42902fca568e5f24e8",
"sha256": "ad6c20cc3443d87b559188e0bbeedaee54047ccfd5e798fb938c15c1e778dd8a"
},
{
"path": "package.json",
"tlsh": "ec012614ce218e7325d92596982d4186a250d94b8e10fc0c33da569d5f4e97f22fe76c",
"sha256": "58f81cf44d62fd20ae760058e0bf0899a0c1bf3768d925ce40736f5045494aea"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "f0a121e58ee11e69d792da8f3bdb92136e08a9e0",
"sha512_sri": "sha512-22pdXhYJXq0dPwULKe29E0fxLiQTo8+FEjz/AWZ9lfpMR0WJmmxcCYxMCKGfMZSa3BgYYT67ijLwCPq76QZaUg=="
},
"filename": "fastify-bundler-1.4.13.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #6243 · Revision 1
- Added to Heist Feed
- Publisher date