# MAL-2026-10531: Malicious code in chain-devkit (npm)


- **Type:** Malicious package
- **Package:** `chain-devkit` (npm)
- **Published:** 14 Jul 2026

## What is MAL-2026-10531?

MAL-2026-10531 is a malicious package in chain-devkit, published on 14 Jul 2026. 

### Official description

The postinstall script fetches YAML from https://chain-devkit.com/config with no version pin, hash, or signature check, then parses it with js-yaml 3.12.0's yaml.load, which honors!!js/function and!!js/regexp tags and constructs Function objects at parse time. The parsed object is written to chain.config.yaml and re-loaded at require() time via the same unsafe loader, giving whoever controls chain-devkit.com a live channel to inject arbitrary JavaScript Function objects into installer processes at every install and every require. Current index.js only reads scalar fields (chainId, rpcUrl, network), so code execution is not automatically triggered on today's config content, but the injected Function values persist in the on-disk config and would execute if any consumer or future package version invokes them. Publisher metadata is thin (atomicmail.io author email, fresh package with no history), and the destination host is controlled by the same anonymous publisher, so the fetch is effectively an attacker-controlled update channel bolted onto npm install.

## What should I do about MAL-2026-10531?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-10531 is a malicious package: chain-devkit (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-10531/ (Markdown: https://insights.sbomify.com/MAL-2026-10531/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-10531

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-10531/
Summaries are generated and may contain mistakes; the official description above is the record.