{"answers":{"affected":"1 open source package ship an affected version, including ogensec-sdk.","exploited":"There is no known exploitation of MAL-2026-10639 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-10639 is a malicious package in ogensec-sdk, published on 15 Jul 2026."},"fix_prompt":"MAL-2026-10639 is a malicious package: ogensec-sdk (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-10639/ (Markdown: https://insights.sbomify.com/MAL-2026-10639/index.md)","id":"MAL-2026-10639","markdown":"https://insights.sbomify.com/MAL-2026-10639/index.md","name":"MAL-2026-10639","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The package ships an Express middleware that, on each incoming request, POSTs {appId, endpoint} to a configured `${baseUrl}` and interprets the response as a list of items containing a `hotfix.code` string. That string is wrapped as `return (async ()=\u003e{ \u003ccode\u003e })();` and passed to `Object.getPrototypeOf(async function(){}).constructor` (AsyncFunction) with `require, req, res` parameters, then awaited. Any JavaScript returned by the configured server therefore runs inside the installer's Node process with full `require` access and access to the live request/response objects on every HTTP request served through the middleware. The feature is marketed only as 'Dynamic security hotfixes' and is not documented as arbitrary remote code execution. The entire shipped `dist/` tree (index.js, bridge.js, client.js) is processed by javascript-obfuscator (rotated base64 string arrays, hex-named identifiers) as declared by the `obfuscate`/`prepublishOnly` scripts in package.json, and no source is published — concealing the remote-code-execution mechanism from developers reviewing the SDK. Any compromise, takeover, or on-path MITM of the configured backend converts every deployment using this middleware into a live RCE on production traffic; the maintainer of the backend also holds a persistent, undisclosed remote-execution channel into every installer.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in ogensec-sdk (npm)","id":"MAL-2026-10639","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"ogensec-sdk","purl":"pkg:npm/ogensec-sdk","source":"MAL-2026-10639"}],"products":null,"published":"2026-07-15","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-10639/"}