{"answers":{"affected":"1 open source package ship an affected version, including router-processor.","exploited":"There is no known exploitation of MAL-2026-10453 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-10453 is a malicious package in router-processor, published on 13 Jul 2026."},"fix_prompt":"MAL-2026-10453 is a malicious package: router-processor (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-10453/ (Markdown: https://insights.sbomify.com/MAL-2026-10453/index.md)","id":"MAL-2026-10453","markdown":"https://insights.sbomify.com/MAL-2026-10453/index.md","name":"MAL-2026-10453","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"router-processor@1.5.2 exposes a getPlugin function that assembles the URL https://svganchordev.net/icons/107 from split constants (protocol, separator, domain, path), fetches a JSON response, and passes the `credits` field to `new Function(...)` which is then invoked with a context object exposing `require`, `process`, `Buffer`, and other Node.js internals. This executes arbitrary attacker-controlled JavaScript with full Node privileges in the caller's process. The package declares dependencies on DPAPI bindings (Windows credential decryption), better-sqlite3, and node-machine-id, which are consistent with an infostealer loader capable of decrypting browser credential stores. The package's identity is inconsistent: package.json describes a router processor while the README advertises a Polymarket SDK, and neither matches the observed behavior of fetching remote code from an SVG-themed cover-story domain. The URL split-construction and the misleading `credits`/`getPlugin` naming are deliberate evasion of casual review.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in router-processor (npm)","id":"MAL-2026-10453","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"router-processor","purl":"pkg:npm/router-processor","source":"MAL-2026-10453"}],"products":null,"published":"2026-07-13","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-10453/"}