MAL-2026-10098 Malicious code in fastify-addone (npm)
Malicious package
Published
MAL-2026-10098 is a malicious package: fastify-addone (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-10098/ (Markdown: https://insights.sbomify.com/MAL-2026-10098/index.md)
- Package
- fastify-addone
- Registry
- npm
What is MAL-2026-10098?
MAL-2026-10098 is a malicious package in fastify-addone, published on 9 Jul 2026.
Official description
The package presents itself as fastify-plugin (name fastify-addone, repository/homepage/bugs fields point at fastify/fastify-plugin) and copies that project's source with a malicious statement inserted. lib/getPluginName.js contains a top-level statement that base64-decodes a URL via atob, fetches the JSON at https://www.jsonkeeper.com/b/HDXPP, and passes the returned content field to eval. This executes attacker-controlled JavaScript in the caller's process on any require('fastify-addone') (directly or via plugin.js). The destination is an anonymous, mutable third-party JSON-hosting service — not the publisher's infrastructure — and the payload URL is hidden behind base64 to evade casual review.
What should I do about MAL-2026-10098?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.