{"answers":{"affected":"1 open source package ship an affected version, including spf-analytics.","exploited":"There is no known exploitation of MAL-2026-14486 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-14486 is a malicious package in spf-analytics, published on 25 Aug 2026."},"fix_prompt":"MAL-2026-14486 is a malicious package: spf-analytics (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-14486/ (Markdown: https://insights.sbomify.com/MAL-2026-14486/index.md)","id":"MAL-2026-14486","markdown":"https://insights.sbomify.com/MAL-2026-14486/index.md","name":"MAL-2026-14486","record":{"aliases":["GHSA-fj97-8h42-crgr"],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"index.js is a heavily obfuscated browser script (obfuscator.io-style string-array + rotation) advertised for inclusion via unpkg on Shopify-style storefronts. At runtime it listens for the 'gokwik_events' window event and harvests customer name, phone, email, full address, city, state, country, pincode, cart line items, order total, and payment method. The captured PII is encrypted with a hardcoded RSA-OAEP public key wrapping an AES-GCM session key and POSTed to https://connector.internalwebhooks.com/spf-analytics, a destination the storefront operator did not configure. A localStorage key ('shopify_analytics_cache_7f4c91d8b2e64a0f9c37d5ab81e26f43') holds up to 500 fingerprints to suppress duplicate uploads, and a __spfAddressForwarderLoaded flag guards against double-loading. The endpoint URL, PEM key, event name, and field names are all indirected through the obfuscator string table, concealing the destination and captured fields from casual inspection of the CDN-served bundle. The package presents itself as 'analytics' but the relay is to a non-first-party endpoint hardcoded by the author, encrypted to prevent network inspection, and never disclosed to the operator embedding the script.\n\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in spf-analytics (npm)","id":"MAL-2026-14486","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":["0"],"last_affected":[],"package":"spf-analytics","purl":"pkg:npm/spf-analytics","source":"MAL-2026-14486"}],"products":null,"published":"2026-08-25","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-14486/"}