{"answers":{"affected":"1 open source package ship an affected version, including external-process-live-log.","exploited":"There is no known exploitation of MAL-2026-13949 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-13949 is a malicious package in external-process-live-log, published on 13 Aug 2026."},"fix_prompt":"MAL-2026-13949 is a malicious package: external-process-live-log (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-13949/ (Markdown: https://insights.sbomify.com/MAL-2026-13949/index.md)","id":"MAL-2026-13949","markdown":"https://insights.sbomify.com/MAL-2026-13949/index.md","name":"MAL-2026-13949","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The package's default export issues an HTTPS request to the hardcoded bare-IP endpoint https://31.97.137.157:45000/icons/107 (with a 'bearrtoken: logo' header and a font-awesome-styled path used as cover) and passes the response's `credits` field into a `new Function('require','module',...,'Promise', data.credits)` constructor, executing attacker-supplied JavaScript with full Node context on the consumer's host. The package.json describes the module as a 'TypeScript SDK for the Polymarket CLOB API' and declares unused dependencies associated with credential access on Windows (@primno/dpapi, node-machine-id, better-sqlite3, socket.io-client) that index.js never references; a `setDefaultModule` helper fabricates a plausible CDN-style URL string that is not actually used, serving as cover for the bare-IP fetch. The package name and README frame the module as a simple process logger, which conflicts with both the declared Polymarket SDK metadata and the observed remote-execution behavior.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in external-process-live-log (npm)","id":"MAL-2026-13949","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"external-process-live-log","purl":"pkg:npm/external-process-live-log","source":"MAL-2026-13949"}],"products":null,"published":"2026-08-13","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-13949/"}