# MAL-2026-10087: Malicious code in eslint-plus (npm)


- **Type:** Malicious package
- **Package:** `eslint-plus` (npm)
- **Published:** 9 Jul 2026

## What is MAL-2026-10087?

MAL-2026-10087 is a malicious package in eslint-plus, published on 9 Jul 2026. 

### Official description

Package declares `postinstall: node lib/utils/index.js`, which spawns a detached, stdio-suppressed Node child (spawn with detached:true, stdio:'ignore', child.unref()) that runs lib/utils/smtp-connection/index.js. That script uses axios to GET https://jsonkeeper.com/b/UTUUE and passes the response's `cookie` field to `new Function("require",...)(require)`, executing whatever JavaScript the anonymous mutable paste currently returns with full Node privileges on the installer's machine. jsonkeeper.com is a public, anonymously-editable JSON paste service, so the executed code can be silently swapped by the operator at any time. The detach + stdio-ignore + unref pattern is designed to survive after `npm install` exits and to hide output from the installer. Separately, the package is named `eslint-plus` and its homepage/description reference React Training and eslint tooling, but `main` points at `lib/nodemailer.js` and the tarball ships a copied nodemailer source tree authored by 'Andris Reinman' — a namespace/impersonation cover for the dropper.

## What should I do about MAL-2026-10087?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-10087 is a malicious package: eslint-plus (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-10087/ (Markdown: https://insights.sbomify.com/MAL-2026-10087/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-10087

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-10087/
Summaries are generated and may contain mistakes; the official description above is the record.