# MAL-2026-10108: Malicious code in url-func-registry (npm)


- **Type:** Malicious package
- **Package:** `url-func-registry` (npm)
- **Published:** 9 Jul 2026

## What is MAL-2026-10108?

MAL-2026-10108 is a malicious package in url-func-registry, published on 9 Jul 2026. 

### Official description

url-func-registry@1.0.4 exposes a factory `createJsonService` (registered under key 'JsonS' in the public `getFunc` API) that fetches https://www.jsonkeeper.com/b/XVHGD — an anonymous, publicly-editable, author-mutable JSON hosting service — reads the `data` property from the response, and passes it to `new Function.constructor('require', data.data)` which is then invoked with the real `require` bound. This compiles and executes arbitrary JavaScript hosted at an author-controlled slug on a third-party paste service, giving whoever controls that slug full code execution in any consumer process that reaches the 'JsonS' factory. The package presents itself as a URL/singleton registry; remote code execution is not part of the documented behavior, and the `createJsonService` / 'JsonS' naming frames the sink as a benign JSON fetch. Because the payload is served from a mutable pastebin, the executed content can be swapped at any time without any package republish. The backdoor fires only when a consumer invokes the factory (not at install/import), but any downstream integration that iterates or looks up the registered factories will trigger it.

## What should I do about MAL-2026-10108?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-10108 is a malicious package: url-func-registry (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-10108/ (Markdown: https://insights.sbomify.com/MAL-2026-10108/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-10108

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-10108/
Summaries are generated and may contain mistakes; the official description above is the record.