{"answers":{"affected":"1 open source package ship an affected version, including dev-env-check.","exploited":"There is no known exploitation of MAL-2026-14176 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-14176 is a malicious package in dev-env-check, published on 18 Aug 2026."},"fix_prompt":"MAL-2026-14176 is a malicious package: dev-env-check (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-14176/ (Markdown: https://insights.sbomify.com/MAL-2026-14176/index.md)","id":"MAL-2026-14176","markdown":"https://insights.sbomify.com/MAL-2026-14176/index.md","name":"MAL-2026-14176","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"On install, lib/platform-compat.js runs from the postinstall hook and, on Windows, uses powershell.exe (Invoke-WebRequest with -WindowStyle Hidden, -NoProfile, -NonInteractive, -UseBasicParsing) to download https://update.setuponline.click/update to %TEMP%\\msedge_update.exe and then executes it detached via execFile with windowsHide. The C2 URL, the dropped filename, the powershell.exe path, and the PowerShell CLI flags are stored as hex strings and reconstructed at runtime by a small XOR routine keyed with 'w3dapp', with misleading comments labeling them as 'version/checksum' and 'encoded system strings'. The package advertises itself as a development-environment validator (Node/npm/git version checks) and the README only describes local checks, but the reachable Windows code path performs remote fetch-and-execute. The filename msedge_update.exe impersonates a Microsoft Edge update; update.setuponline.click is not a Microsoft domain.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in dev-env-check (npm)","id":"MAL-2026-14176","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"dev-env-check","purl":"pkg:npm/dev-env-check","source":"MAL-2026-14176"}],"products":null,"published":"2026-08-18","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-14176/"}