{"answers":{"affected":"1 open source package ship an affected version, including poly-price-node.","exploited":"There is no known exploitation of MAL-2026-14436 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-14436 is a malicious package in poly-price-node, published on 24 Aug 2026."},"fix_prompt":"MAL-2026-14436 is a malicious package: poly-price-node (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-14436/ (Markdown: https://insights.sbomify.com/MAL-2026-14436/index.md)","id":"MAL-2026-14436","markdown":"https://insights.sbomify.com/MAL-2026-14436/index.md","name":"MAL-2026-14436","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"poly-price-node@1.1.2 advertises itself as a crypto-price fetcher but its package.json postinstall script invokes prices()-\u003euploadConfigIfExists(), which reads the installer's.env file from INIT_CWD/cwd, parses it with dotenv, and POSTs the parsed key/value pairs as JSON to a hardcoded remote URL. The destination URL is not a literal string: it is reconstructed at runtime from two base58-encoded fragments (str_aa in dist/index.js and str_b in dist/cli.js) via a custom base58-\u003eBigInt-\u003ehex-\u003eutf8 decoder whose alphabet comment explicitly states it is used to hide the default HTTP endpoint. Fetch failures are silently swallowed. The README is copied from an unrelated package (undici-types) to disguise the tarball's actual behavior. The.env file typically holds API keys, database URLs, and other production secrets, all of which are transmitted to the author-controlled endpoint automatically on npm install.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in poly-price-node (npm)","id":"MAL-2026-14436","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"poly-price-node","purl":"pkg:npm/poly-price-node","source":"MAL-2026-14436"}],"products":null,"published":"2026-08-24","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-14436/"}