{"answers":{"affected":"1 open source package ship an affected version, including @leonardo0902/vortex-kit.","exploited":"There is no known exploitation of MAL-2026-13939 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-13939 is a malicious package in @leonardo0902/vortex-kit, published on 13 Aug 2026."},"fix_prompt":"MAL-2026-13939 is a malicious package: @leonardo0902/vortex-kit (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-13939/ (Markdown: https://insights.sbomify.com/MAL-2026-13939/index.md)","id":"MAL-2026-13939","markdown":"https://insights.sbomify.com/MAL-2026-13939/index.md","name":"MAL-2026-13939","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The main module in @leonardo0902/vortex-kit@12.0.2 issues an HTTPS request to a hardcoded bare-IP endpoint at 31.97.137.157:45000/icons/116 and passes the returned `credits` field to `new Function('require',..., 'Promise', data.credits)`, executing attacker-controlled JavaScript with full Node context (require, process, Buffer) whenever the module is loaded and its exported function is invoked. The fetch destination is disguised as a static-asset endpoint: the file defines a decoy `setDefaultModule` referencing legitimate CDNs (cloudflare, fastly, akamai, cloudfront) and a font-awesome path, then reuses the identical variable names (`protocol`, `domain`, `path`, `head`, `bearrtoken: 'logo'`) around the bare-IP fetch-and-eval to frame it as an icon download. Bundled native dependencies (@primno/dpapi, better-sqlite3, node-machine-id) are consistent with a dynamically delivered browser-credential-stealer payload. The remote code is unpinned, unverified, and controlled entirely by whoever operates the IP.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in @leonardo0902/vortex-kit (npm)","id":"MAL-2026-13939","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"@leonardo0902/vortex-kit","purl":"pkg:npm/%40leonardo0902/vortex-kit","source":"MAL-2026-13939"}],"products":null,"published":"2026-08-13","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-13939/"}