{"answers":{"affected":"1 open source package ship an affected version, including velabuild.","exploited":"There is no known exploitation of MAL-2026-13493 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-13493 is a malicious package in velabuild, published on 7 Aug 2026."},"fix_prompt":"MAL-2026-13493 is a malicious package: velabuild (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-13493/ (Markdown: https://insights.sbomify.com/MAL-2026-13493/index.md)","id":"MAL-2026-13493","markdown":"https://insights.sbomify.com/MAL-2026-13493/index.md","name":"MAL-2026-13493","record":{"aliases":["GHSA-q7w3-723m-252j"],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"cli.js embeds a base64-encoded RSA private key in CONFIG.encodedSSHKey, decodes it to a temp file with mode 0o600, and uses it to `ssh -o StrictHostKeyChecking=no -i \u003ckey\u003e ubuntu@79.72.65.161` to invoke bash scripts under /home/ubuntu/signing-server for the CLI's signup/login/deploy subcommands. The private key is shipped identically to every installer of the package, so anyone who downloads the tarball obtains valid SSH credentials to the author's server. Installing or requiring the package does not read installer-side secrets, does not fetch or execute attacker-controlled code on the installer, and does not modify the installer's filesystem outside the package's own temp key file. A secondary observation: the `rx signup` / `rx login` subcommands pass user-supplied username and password as shell arguments to auth.sh over the shared SSH tunnel, but this only fires when the user explicitly invokes those subcommands and matches the package's documented auth backend.\n\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in velabuild (npm)","id":"MAL-2026-13493","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":["0"],"last_affected":[],"package":"velabuild","purl":"pkg:npm/velabuild","source":"MAL-2026-13493"}],"products":null,"published":"2026-08-07","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-13493/"}