# MAL-2026-14369: Malicious code in @syncraft-labs/vue (npm)


- **Type:** Malicious package
- **Package:** `@syncraft-labs/vue` (npm)
- **Published:** 23 Aug 2026
- **Also known as:** GHSA-pv4r-p86x-36rw

## What is MAL-2026-14369?

MAL-2026-14369 is a malicious package in @syncraft-labs/vue, published on 23 Aug 2026. 

### Official description

The ESM build dist/index.js of @syncraft-labs/vue@0.4.1 contains a heavily obfuscated payload injected alongside the otherwise-legitimate Vue plugin source. The obfuscated region uses an obfuscator.io-style rotating string array (303 entries, _0x240a/_0x4963 decoders) and opaque predicates to hide a loader that requires http/https/zlib and child_process.spawn, queries Ethereum RPC endpoints (publicnode.com/ethereum-rpc, drpc.org/eth, blockscout) and an Etherscan-style txlist endpoint for the hardcoded address 0xa322E5f3..., decodes base64/gzip content from returned transaction data, and passes it to child_process.spawn. This is the EtherHiding blockchain-hosted C2 dropper pattern: any consumer importing @syncraft-labs/vue via ESM (the package's `module` entry) resolves an attacker-controlled runtime payload from Ethereum transactions and executes it, yielding remote code execution on the host performing the import. The CJS build and sourcemap are clean, indicating the ESM artifact was tampered after build to smuggle the loader while leaving createSyncraft/useSync and the vue/@syncraft-labs/core imports intact.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

## What should I do about MAL-2026-14369?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-14369 is a malicious package: @syncraft-labs/vue (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-14369/ (Markdown: https://insights.sbomify.com/MAL-2026-14369/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-14369

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-14369/
Summaries are generated and may contain mistakes; the official description above is the record.