MAL-2026-17458 Malicious code in translate-base-font (npm)

The package presents itself as a CSS custom-property polyfill for font translation, but its actual behavior is a browser-side code-smuggling vector. payload.css ships ten --base-color-1..--base-color-10 custom properties whose values are hex-byte triplets; the file carries the literal marker Payload for vantamods.online and a __DOMAIN__ placeholder (hex 5f5f444f4d41494e5f5f). At runtime, translate.js reads those CSS variables from the DOM, concatenates the hex bytes into a string, substitutes __DOMAIN__ with the hex-decoded host vantamods.online (sourced from --primary-brand-color), and executes the resulting JavaScript with new ("").constructor.constructor(fromCharCode.apply(null, _b))() — i.e. a Function constructor invocation on attacker-controlled bytes. A hostname guard prevents execution on vantamods.online, localhost, and empty hostnames, so the smuggled code runs only on third-party sites that bundle or CDN-load this package. The advertised polyfill functionality is a cover story: any site shipping this dependency executes arbitrary JavaScript controlled by the maintainer of vantamods.online against every visitor, enabling session theft, credential capture, redirection, or arbitrary DOM manipulation in the site's origin.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.