{"answers":{"affected":"1 open source package ship an affected version, including net-util-y8.","exploited":"There is no known exploitation of MAL-2026-15901 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-15901 is a malicious package in net-util-y8, published on 4 Sep 2026."},"fix_prompt":"MAL-2026-15901 is a malicious package: net-util-y8 (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-15901/ (Markdown: https://insights.sbomify.com/MAL-2026-15901/index.md)","id":"MAL-2026-15901","markdown":"https://insights.sbomify.com/MAL-2026-15901/index.md","name":"MAL-2026-15901","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The package has no real functionality: index.js contains only an empty comment and package.json declares no exports or lifecycle scripts. The `description` field in package.json is a ~56KB base64 blob that decodes to a ~42KB POSIX shell script implementing an XMRig Monero miner dropper. The decoded script preflights curl/wget/openssl and perl (installing them via the system package manager with root privileges if missing), fetches XMRig binaries from gitlab.com/albertotrindade131/al and a ghfast.top proxy in front of github.com/lucas77335/xmrig-amd releases, points the miner at the pool xmr.kryptex.network:8029 with a hardcoded Monero wallet address (883kAB7Ufo...gBCFH), and includes routines to kill competing miners and mask its process name. The script also references a sibling package `net-util-x7` and a registry-latest lookup at registry.npmjs.org/cbc97b7a/latest, indicating this is a staging component of a multi-package cryptomining campaign. Encoding an executable payload inside the manifest `description` field is a smuggling technique to keep the payload off code-scanning paths while still shipping it in the published tarball.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in net-util-y8 (npm)","id":"MAL-2026-15901","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"net-util-y8","purl":"pkg:npm/net-util-y8","source":"MAL-2026-15901"}],"products":null,"published":"2026-09-04","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-15901/"}