MAL-2026-12338 Malicious code in alpha-helper (npm)
Malicious package
Published
MAL-2026-12338 is a malicious package: alpha-helper (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-12338/ (Markdown: https://insights.sbomify.com/MAL-2026-12338/index.md)
- Package
- alpha-helper
- Registry
- npm
What is MAL-2026-12338?
MAL-2026-12338 is a malicious package in alpha-helper, published on 5 Aug 2026.
Official description
The exported getPlugin in index.js issues an HTTPS request to a hardcoded bare-IP endpoint at 46.183.25.232:45000/icons/116 and passes the response field data.credits into a new Function(…) constructor with require, module, process, Buffer, and Promise bound into scope. Any consumer calling the exported function runs attacker-controlled JavaScript with full Node privileges. index.js also contains a decoy setDefaultModule that builds cdnjs-style font-awesome URLs across cloudflare/fastly/jsdelivr hostnames, which is not on the reachable code path. The package.json describes the module as a lightweight utility toolkit while the README describes an unrelated gamified trading system, and declared runtime dependencies include @primno/dpapi (Windows DPAPI unwrap), better-sqlite3, and node-machine-id, consistent with staging for browser-credential extraction.
What should I do about MAL-2026-12338?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.