MAL-2026-13371 Malicious code in multi-acct (npm)
Malicious package
Published
MAL-2026-13371 is a malicious package: multi-acct (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-13371/ (Markdown: https://insights.sbomify.com/MAL-2026-13371/index.md)
- Package
- multi-acct
- Registry
- npm
What is MAL-2026-13371?
MAL-2026-13371 is a malicious package in multi-acct, published on 5 Aug 2026.
Official description
[email protected] is a near-empty wrapper (index.js is a two-line stub returning name/version literals; author is the generic 'Package Registry' and repository.url points at an example.com-style placeholder). Its sole functional dependency,
vector-cursor-stream-engine, is not resolved from the npm registry but from a hardcoded third-party HTTPS URL, https://artifacts.yosiroute.com/npm/vector-cursor-stream-engine, and the shrinkwrap marks that dependency as hasInstallScript:true. On npm install, npm downloads the tarball from artifacts.yosiroute.com and executes its lifecycle scripts, so whoever controls that host gets arbitrary code execution on the installer's machine. The URL is unpinned and carries no integrity hash, so the delivered bytes can change at any time. The wrapper shape (placeholder metadata, trivial main, single off-registry dependency with install scripts) matches a dependency-confusion / lure package whose real payload is delivered through the fetched sub-tarball.What should I do about MAL-2026-13371?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.