{"answers":{"affected":"1 open source package ship an affected version, including deposit-limit-fe.","exploited":"There is no known exploitation of MAL-2026-17769 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-17769 is a malicious package in deposit-limit-fe, published on 11 Oct 2026."},"fix_prompt":"MAL-2026-17769 is a malicious package: deposit-limit-fe (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-17769/ (Markdown: https://insights.sbomify.com/MAL-2026-17769/index.md)","id":"MAL-2026-17769","markdown":"https://insights.sbomify.com/MAL-2026-17769/index.md","name":"MAL-2026-17769","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"deposit-limit-fe@100.100.101 is published as a 'Deposit limit frontend utilities' library but its main entry (index.js) exports an empty object and ships no real functionality. package.json declares `postinstall: node postinstall.js`, which require()s a bundled Linux x64 native addon at `prebuilds/linux-x64/addon.node` inside a silenced try/catch. The addon has no corresponding C/C++ source or binding.gyp in the tarball. On load it reads the environment variables HOSTNAME, USER, npm_package_name, and npm_config_registry, forks, opens a TCP socket to the hardcoded bare IP 64.181.165.115, and sends `POST /dc HTTP/1.0` with a form-encoded body `h=\u003chostname\u003e\u0026p=\u003cpackage\u003e\u0026u=\u003cuser\u003e\u0026r=\u003cregistry\u003e`. The anomalous 100.100.101 version and the explicit exfiltration of `npm_config_registry` are the fingerprint of a dependency-confusion reconnaissance beacon targeting an internal/private npm registry package name. Installing this package automatically leaks the installer's hostname, OS username, and private npm registry URL to an attacker-controlled endpoint and executes opaque native code on the installer's machine.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in deposit-limit-fe (npm)","id":"MAL-2026-17769","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"deposit-limit-fe","purl":"pkg:npm/deposit-limit-fe","source":"MAL-2026-17769"}],"products":null,"published":"2026-10-11","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-17769/"}