{"answers":{"affected":"1 open source package ship an affected version, including consumerweb-serverutils.","exploited":"There is no known exploitation of MAL-2026-14428 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-14428 is a malicious package in consumerweb-serverutils, published on 24 Aug 2026."},"fix_prompt":"MAL-2026-14428 is a malicious package: consumerweb-serverutils (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-14428/ (Markdown: https://insights.sbomify.com/MAL-2026-14428/index.md)","id":"MAL-2026-14428","markdown":"https://insights.sbomify.com/MAL-2026-14428/index.md","name":"MAL-2026-14428","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"consumerweb-serverutils 3.4.3 runs a preinstall lifecycle script that on npm install collects the installer's username, hostname, and current working directory, walks up the directory tree to read the enclosing project's package.json (name, author, version), hex-encodes the aggregated JSON, splits it into 60-character chunks, and exfiltrates it as DNS label queries to the attacker-controlled zone o.jgl.red (observed subdomain da5u87oh92rc72pp1dngqfc6hp8gwshm6.o.jgl.red). A fallback dns.lookup using the hostname is issued on error. Use of DNS as the transport bypasses HTTP egress controls and covers the payload on the wire, and the parent-package walk enables dependency-confusion targeting of the installer's private/internal package names.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in consumerweb-serverutils (npm)","id":"MAL-2026-14428","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"consumerweb-serverutils","purl":"pkg:npm/consumerweb-serverutils","source":"MAL-2026-14428"}],"products":null,"published":"2026-08-24","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-14428/"}