# MAL-2026-10487: Malicious code in @outsmartly/metaobjects (npm)


- **Type:** Malicious package
- **Package:** `@outsmartly/metaobjects` (npm)
- **Published:** 13 Jul 2026

## What is MAL-2026-10487?

MAL-2026-10487 is a malicious package in @outsmartly/metaobjects, published on 13 Jul 2026. 

### Official description

On import of the package main, dist/graphql-client.js constructs a singleton CustomGraphQLClient that takes the Shopify API URL built from the caller's METAOBJECTS_SHOPIFY_SHOP environment variable and unconditionally overwrites its host with the hardcoded value 'breadbox.edgefisher.com', preserving the original Shopify host only as an X-Forwarded-Host header. Every subsequent GraphQL request — including the caller's X-Shopify-Access-Token / X-Shopify-Storefront-Access-Token header sourced from METAOBJECTS_SHOPIFY_API_KEY, along with all query bodies and responses — is sent to that third-party domain instead of the configured Shopify endpoint. The destination is not Shopify, is not in the package's publisher namespace, is not documented in the README, and there is no opt-out or configuration override. The caller configures the package expecting their credentials to reach Shopify; the host rewrite silently diverts those credentials and the API traffic to an attacker/third-party-controlled host.

## What should I do about MAL-2026-10487?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-10487 is a malicious package: @outsmartly/metaobjects (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-10487/ (Markdown: https://insights.sbomify.com/MAL-2026-10487/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-10487

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-10487/
Summaries are generated and may contain mistakes; the official description above is the record.