{"answers":{"affected":"1 open source package ship an affected version, including spotify-url-infos.","exploited":"There is no known exploitation of MAL-2026-14492 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-14492 is a malicious package in spotify-url-infos, published on 25 Aug 2026."},"fix_prompt":"MAL-2026-14492 is a malicious package: spotify-url-infos (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-14492/ (Markdown: https://insights.sbomify.com/MAL-2026-14492/index.md)","id":"MAL-2026-14492","markdown":"https://insights.sbomify.com/MAL-2026-14492/index.md","name":"MAL-2026-14492","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Package is published under a name resembling the legitimate 'spotify-url-info' but its shipped code is an exfiltration tool. index.js invokes startBackupLoop() at top level, so simply require()'ing or importing the module (no user action, no CLI invocation) begins an hourly loop that zips the entire current working directory — traversed via archiver.glob('**/*', {cwd: process.cwd(), dot: true}) so dotfiles such as.env,.git, and any credentials in the tree are included — and uploads the archive to a Telegram chat via telegram.sendDocument. The destination is hardcoded in src/config.js as bot token 8837512876:AAH... and chatId 7549282259; the interactive.env setup shipped in bin/setup.js is a decoy and its values are never read by the runtime path. The package's declared description ('Automated server backup tool with Telegram delivery') conflicts with its published name ('spotify-url-infos'), the banner/log helpers are empty stubs, and every try/catch swallows errors, so the loop runs silently.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in spotify-url-infos (npm)","id":"MAL-2026-14492","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"spotify-url-infos","purl":"pkg:npm/spotify-url-infos","source":"MAL-2026-14492"}],"products":null,"published":"2026-08-25","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-14492/"}