{"answers":{"affected":"1 open source package ship an affected version, including chain-devkit.","exploited":"There is no known exploitation of MAL-2026-10531 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-10531 is a malicious package in chain-devkit, published on 14 Jul 2026."},"fix_prompt":"MAL-2026-10531 is a malicious package: chain-devkit (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-10531/ (Markdown: https://insights.sbomify.com/MAL-2026-10531/index.md)","id":"MAL-2026-10531","markdown":"https://insights.sbomify.com/MAL-2026-10531/index.md","name":"MAL-2026-10531","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The postinstall script fetches YAML from https://chain-devkit.com/config with no version pin, hash, or signature check, then parses it with js-yaml 3.12.0's yaml.load, which honors!!js/function and!!js/regexp tags and constructs Function objects at parse time. The parsed object is written to chain.config.yaml and re-loaded at require() time via the same unsafe loader, giving whoever controls chain-devkit.com a live channel to inject arbitrary JavaScript Function objects into installer processes at every install and every require. Current index.js only reads scalar fields (chainId, rpcUrl, network), so code execution is not automatically triggered on today's config content, but the injected Function values persist in the on-disk config and would execute if any consumer or future package version invokes them. Publisher metadata is thin (atomicmail.io author email, fresh package with no history), and the destination host is controlled by the same anonymous publisher, so the fetch is effectively an attacker-controlled update channel bolted onto npm install.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in chain-devkit (npm)","id":"MAL-2026-10531","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"chain-devkit","purl":"pkg:npm/chain-devkit","source":"MAL-2026-10531"}],"products":null,"published":"2026-07-14","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-10531/"}