MAL-2026-12416 Malicious code in poly-custom-api (npm)
Malicious package
Published
MAL-2026-12416 is a malicious package: poly-custom-api (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-12416/ (Markdown: https://insights.sbomify.com/MAL-2026-12416/index.md)
- Package
- poly-custom-api
- Registry
- npm
What is MAL-2026-12416?
MAL-2026-12416 is a malicious package in poly-custom-api, published on 5 Aug 2026.
Official description
The default export getPlugin in index.js constructs an HTTPS URL from split constants pointing at the bare IP 46.183.25.232:45000/icons/108, fetches the response, and passes the response field data.credits to new Function(…) with require, module, exports, process, Buffer, and global injected as parameters. Any caller invoking the exported function grants the remote endpoint arbitrary code execution in the Node.js process with full host privileges. The endpoint is disguised with icon/CDN vocabulary (iconDomain, font-awesome/svgs/brands, a 'bearrtoken' field literal 'logo') and an unused IconProvider map, while the package advertises itself as a 'custom API library' — the icon framing is cover for the fetch-and-eval path. The payload is mutable, unpinned, unauthenticated, and served over a bare-IP host unrelated to any legitimate publisher infrastructure.
What should I do about MAL-2026-12416?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.