{"answers":{"affected":"1 open source package ship an affected version, including exodus-firestore-synchronize.","exploited":"There is no known exploitation of MAL-2026-16533 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-16533 is a malicious package in exodus-firestore-synchronize, published on 22 Sep 2026."},"fix_prompt":"MAL-2026-16533 is a malicious package: exodus-firestore-synchronize (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-16533/ (Markdown: https://insights.sbomify.com/MAL-2026-16533/index.md)","id":"MAL-2026-16533","markdown":"https://insights.sbomify.com/MAL-2026-16533/index.md","name":"MAL-2026-16533","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"package.json declares a postinstall hook that auto-runs on `npm install` and executes `whoami` and `hostname`, then enumerates `process.env` for keys matching /TOKEN|SECRET|KEY|AUTH|npm/i and prints the matches to stdout. The package name and description impersonate an internal 'Exodus Wallet SDK' and self-identify as a dependency-confusion demonstrator published to the public registry to intercept installers that misroute an internal package name to this public one. No outbound network sink is present in this version, so the enumerated environment values and host identifiers are written only to the install log rather than transmitted; however, on CI systems those install logs are frequently captured, archived, or exposed, and the enumeration itself targets credential-shaped environment variables.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in exodus-firestore-synchronize (npm)","id":"MAL-2026-16533","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"exodus-firestore-synchronize","purl":"pkg:npm/exodus-firestore-synchronize","source":"MAL-2026-16533"}],"products":null,"published":"2026-09-22","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-16533/"}