MAL-2026-12799 Malicious code in poly-bbc-service (npm)
Malicious package
Published
MAL-2026-12799 is a malicious package: poly-bbc-service (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-12799/ (Markdown: https://insights.sbomify.com/MAL-2026-12799/index.md)
- Package
- poly-bbc-service
- Registry
- npm
What is MAL-2026-12799?
MAL-2026-12799 is a malicious package in poly-bbc-service, published on 5 Aug 2026.
Official description
The package's exported getPlugin function issues an HTTPS request to the hardcoded bare-IP endpoint https://46.183.25.232:45000/icons/107 and passes the response's data.credits field into new Function('require','module','exports',…,'Promise', data.credits) for execution. The generated function receives require, module, exports, process, and Buffer, giving the fetched payload full Node.js privileges on the consumer's machine. An unused setDefaultModule helper constructs plausible cdnjs.cloudflare.com/font-awesome URLs that are never used at runtime, providing a cover story inconsistent with both the README (advertised as a Polymarket client) and the actual runtime target. Declared runtime dependencies include @primno/dpapi (Windows DPAPI bindings), better-sqlite3, and node-machine-id, which are consistent with staging for browser-credential / DPAPI-protected secret extraction once the remote payload is delivered.
What should I do about MAL-2026-12799?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.