Skip to content
Heist/ feed
Unrated

Malicious code in fastify-bundler (npm)

Type: advisorySource: OSV1 source record

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b3d824f75a77642b33c2c29524f9decca40c16a12aabe0a2528f3d90deac8720) The package's exported getPlugin function fetches JSON from https://svganchordev.net/icons/105 and passes the response's data.credits field to new Function() with require, module, process, Buffer, and other Node globals bound, then invokes it. Any consumer that imports fastify-bundler and calls the advertised API executes attacker-supplied JavaScript with full Node privileges; the remote operator can change the payload at any time. The package's declared dependencies (@primno/dpapi for Windows DPAPI credential decryption, better-sqlite3/sqlite3 for Chromium Login Data and Cookies stores, node-machine-id for host fingerprinting, socket.io-client, axios, request) are injected into the require() available to the remote payload, providing a ready-made toolkit for browser-credential theft and C2. The package identity is also deceptive: it is published as 'fastify-bundler' with a description claiming to be a 'high-performance web framework for Node.js', while the shipped README is titled 'Tailwindcss Forms Bundler' and instructs users to `npm install tailwindcss-forms-bundle' — a name/README mismatch targeting three unrelated popular ecosystems to attract installs. ## Source: ghsa-malware (4598c4d755d8e4c070b9218010d931db827742bfae319600afd609c186bcd446) Any computer that has this package installed or running should be considered

Announced Source revision 1
Original source ↗

MAL-2026-10520

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:MAL-2026-10520

fastify-bundler

Source reference: /affected/0/package/name

Affected versions
1.4.13

Source reference: /affected/0/versions

1.4.16

Source reference: /affected/0/versions

1.4.15

Source reference: /affected/0/versions

1.4.14

Source reference: /affected/0/versions

Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "fastify-bundler",
      "purl": "pkg:npm/fastify-bundler",
      "ecosystem": "npm"
    },
    "versions": [
      "1.4.13",
      "1.4.16",
      "1.4.15",
      "1.4.14"
    ],
    "database_specific": {
      "cwes": [
        {
          "name": "Embedded Malicious Code",
          "cweId": "CWE-506",
          "description": "The product contains code that appears to be malicious in nature."
        },
        {
          "name": "Embedded Malicious Code",
          "cweId": "CWE-506",
          "description": "The product contains code that appears to be malicious in nature."
        },
        {
          "name": "Embedded Malicious Code",
          "cweId": "CWE-506",
          "description": "The product contains code that appears to be malicious in nature."
        },
        {
          "name": "Embedded Malicious Code",
          "cweId": "CWE-506",
          "description": "The product contains code that appears to be malicious in nature."
        },
        {
          "name": "Embedded Malicious Code",
          "cweId": "CWE-506",
          "description": "The product contains code that appears to be malicious in nature."
        }
      ],
      "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/fastify-bundler/MAL-2026-10520.json",
      "indicators": {
        "evidence_files": [
          {
            "path": "index.js",
            "tlsh": "00c1616546fa21a36a67e4edf30f100271a6e2133758e971f48e42902fca568e5f24e8",
            "sha256": "ad6c20cc3443d87b559188e0bbeedaee54047ccfd5e798fb938c15c1e778dd8a"
          },
          {
            "path": "package.json",
            "tlsh": "ec012614ce218e7325d92596982d4186a250d94b8e10fc0c33da569d5f4e97f22fe76c",
            "sha256": "58f81cf44d62fd20ae760058e0bf0899a0c1bf3768d925ce40736f5045494aea"
          }
        ],
        "package_integrity": [
          {
            "hashes": {
              "sha1": "f0a121e58ee11e69d792da8f3bdb92136e08a9e0",
              "sha512_sri": "sha512-22pdXhYJXq0dPwULKe29E0fxLiQTo8+FEjz/AWZ9lfpMR0WJmmxcCYxMCKGfMZSa3BgYYT67ijLwCPq76QZaUg=="
            },
            "filename": "fastify-bundler-1.4.13.tgz"
          }
        ]
      }
    }
  }
]

Publisher severity

No explicit severity was provided.

Event
#6243 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement