{"answers":{"affected":"1 open source package ship an affected version, including htps-provider.","exploited":"There is no known exploitation of MAL-2026-15567 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-15567 is a malicious package in htps-provider, published on 29 Aug 2026."},"fix_prompt":"MAL-2026-15567 is a malicious package: htps-provider (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-15567/ (Markdown: https://insights.sbomify.com/MAL-2026-15567/index.md)","id":"MAL-2026-15567","markdown":"https://insights.sbomify.com/MAL-2026-15567/index.md","name":"MAL-2026-15567","record":{"aliases":["GHSA-gcqr-3vw3-7fqm"],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Package is published as htps-provider with a README copy-pasted verbatim from the legitimate Cosmos chain-registry project (advertising assets, chains, ibc exports and the same install/example snippets). The actual entrypoints do not expose that API: index.js and esm/index.mjs simply re-export HttpProvider from a runtime dependency named supersignaturenature (declared in package.json as \"supersignaturenature\": \"^1.0.6\"). esm/index.mjs performs a top-level static import of that dependency, so any ESM consumer that imports htps-provider immediately executes code from supersignaturenature. The name-and-README cover story, mismatched published API, and use of an obscurely-named third-party dependency as the sole runtime payload match the loader/stager half of a supply-chain attack, with the executable payload delivered through the transitively-installed dependency rather than this tarball. The chain.js files flagged by network/command patterns appear to be inert data/persistence modules unrelated to the loader path.\n\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in htps-provider (npm)","id":"MAL-2026-15567","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":["0"],"last_affected":[],"package":"htps-provider","purl":"pkg:npm/htps-provider","source":"MAL-2026-15567"}],"products":null,"published":"2026-08-29","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-15567/"}