{"answers":{"affected":"1 open source package ship an affected version, including secp256k1-lib.","exploited":"There is no known exploitation of MAL-2026-14255 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-14255 is a malicious package in secp256k1-lib, published on 19 Aug 2026."},"fix_prompt":"MAL-2026-14255 is a malicious package: secp256k1-lib (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-14255/ (Markdown: https://insights.sbomify.com/MAL-2026-14255/index.md)","id":"MAL-2026-14255","markdown":"https://insights.sbomify.com/MAL-2026-14255/index.md","name":"MAL-2026-14255","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Package name mimics the widely used `secp256k1` cryptography library but contains no cryptographic functionality. The declared `main` (`index.js`) is a single 33KB obfuscator.io-packed bundle whose only readable tokens are `require(` and `axios`; all strings — including target hostnames, URLs, and function names — are hex-escaped entries in the `_0x4058` string array that are reconstructed at runtime. README is 24 bytes and the package description (`logger tool for validation entry`) does not match a secp256k1 implementation. On `require('secp256k1-lib')` the obfuscated bundle executes and instantiates an HTTP client (axios) targeting a runtime-constructed destination that could not be recovered from the shipped bytes. Shape matches a credential/wallet-stealer loader: name confusion with a high-value crypto package + no legitimate functionality + obfuscated import-time network capability with a hidden destination.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in secp256k1-lib (npm)","id":"MAL-2026-14255","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"secp256k1-lib","purl":"pkg:npm/secp256k1-lib","source":"MAL-2026-14255"}],"products":null,"published":"2026-08-19","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-14255/"}