# MAL-2026-10453: Malicious code in router-processor (npm)


- **Type:** Malicious package
- **Package:** `router-processor` (npm)
- **Published:** 13 Jul 2026

## What is MAL-2026-10453?

MAL-2026-10453 is a malicious package in router-processor, published on 13 Jul 2026. 

### Official description

router-processor@1.5.2 exposes a getPlugin function that assembles the URL https://svganchordev.net/icons/107 from split constants (protocol, separator, domain, path), fetches a JSON response, and passes the `credits` field to `new Function(...)` which is then invoked with a context object exposing `require`, `process`, `Buffer`, and other Node.js internals. This executes arbitrary attacker-controlled JavaScript with full Node privileges in the caller's process. The package declares dependencies on DPAPI bindings (Windows credential decryption), better-sqlite3, and node-machine-id, which are consistent with an infostealer loader capable of decrypting browser credential stores. The package's identity is inconsistent: package.json describes a router processor while the README advertises a Polymarket SDK, and neither matches the observed behavior of fetching remote code from an SVG-themed cover-story domain. The URL split-construction and the misleading `credits`/`getPlugin` naming are deliberate evasion of casual review.

## What should I do about MAL-2026-10453?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-10453 is a malicious package: router-processor (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-10453/ (Markdown: https://insights.sbomify.com/MAL-2026-10453/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-10453

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-10453/
Summaries are generated and may contain mistakes; the official description above is the record.