{"answers":{"affected":"1 open source package ship an affected version, including @dexwilt/node-fetch.","exploited":"There is no known exploitation of MAL-2026-11203 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-11203 is a malicious package in @dexwilt/node-fetch, published on 22 Jun 2026."},"fix_prompt":"MAL-2026-11203 is a malicious package: @dexwilt/node-fetch (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-11203/ (Markdown: https://insights.sbomify.com/MAL-2026-11203/index.md)","id":"MAL-2026-11203","markdown":"https://insights.sbomify.com/MAL-2026-11203/index.md","name":"MAL-2026-11203","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The @dexwilt/node-fetch package impersonates the legitimate node-fetch project: its package metadata copies the upstream repository, author, and homepage while publishing under an unrelated scope. Its CommonJS entry point lib/index.js contains the expected node-fetch implementation followed by approximately 94 KB of additional RC4/Base64-obfuscated code. The ESM builds do not contain this appended payload.\n\nAgent-assisted deobfuscation of the appended payload recovered a cross-platform download and execution chain. It retrieves a remote binary from an encrypted endpoint, records and verifies the downloaded file's SHA-256 value, and starts the binary with detached, hidden-window, and ignored-stdio options before unreferencing the child process. The original obfuscated source independently exposes the detached, windowsHide, stdio, environment, working-directory, size, SHA-256, and download timestamp fields used by this chain. Loading the package's declared main entry point therefore executes a concealed remote payload loader embedded after otherwise legitimate node-fetch code.\n\n@dexwilt/node-fetch impersonates the popular node-fetch package under a personal scope. Its main entrypoint (lib/index.js, lib/index.mjs, lib/index.es.js) ships the legitimate node-fetch v2 source with two appended, heavily obfuscated self-executing IIFEs that contain RC4+base64 string-array decoders reconstructing calls to https.request, fs.writeFileSync, fs.chmodSync, and child_process.spawn. Execution is gated on process.env.npm_config_user_agent — set by npm/yarn/pnpm during install but absent in plain node/REPL runs — so the payload only fires inside real installs while staying dormant during casual inspection. When triggered, the code re-spawns the current Node process detached with stdio ignored, downloads a remote binary over HTTP(S), writes it to a temp directory, chmods it 0o755, and execs it detached with windowsHide and unref(). Two independent dropper IIFEs are present in the same file, each with its own decoder and download→write→spawn pipeline, increasing reliability. Any developer or build pipeline that requires or installs this package automatically runs attacker-controlled code with persistence beyond the npm process.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in @dexwilt/node-fetch (npm)","id":"MAL-2026-11203","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"@dexwilt/node-fetch","purl":"pkg:npm/%40dexwilt/node-fetch","source":"MAL-2026-11203"}],"products":null,"published":"2026-06-22","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-11203/"}