# MAL-2026-15901: Malicious code in net-util-y8 (npm)


- **Type:** Malicious package
- **Package:** `net-util-y8` (npm)
- **Published:** 4 Sep 2026

## What is MAL-2026-15901?

MAL-2026-15901 is a malicious package in net-util-y8, published on 4 Sep 2026. 

### Official description

The package has no real functionality: index.js contains only an empty comment and package.json declares no exports or lifecycle scripts. The `description` field in package.json is a ~56KB base64 blob that decodes to a ~42KB POSIX shell script implementing an XMRig Monero miner dropper. The decoded script preflights curl/wget/openssl and perl (installing them via the system package manager with root privileges if missing), fetches XMRig binaries from gitlab.com/albertotrindade131/al and a ghfast.top proxy in front of github.com/lucas77335/xmrig-amd releases, points the miner at the pool xmr.kryptex.network:8029 with a hardcoded Monero wallet address (883kAB7Ufo...gBCFH), and includes routines to kill competing miners and mask its process name. The script also references a sibling package `net-util-x7` and a registry-latest lookup at registry.npmjs.org/cbc97b7a/latest, indicating this is a staging component of a multi-package cryptomining campaign. Encoding an executable payload inside the manifest `description` field is a smuggling technique to keep the payload off code-scanning paths while still shipping it in the published tarball.

## What should I do about MAL-2026-15901?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-15901 is a malicious package: net-util-y8 (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-15901/ (Markdown: https://insights.sbomify.com/MAL-2026-15901/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-15901

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-15901/
Summaries are generated and may contain mistakes; the official description above is the record.