{"answers":{"affected":"1 open source package ship an affected version, including @chahuadev/junk-sweeper-app.","exploited":"There is no known exploitation of MAL-2026-3682 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-3682 is a malicious package in @chahuadev/junk-sweeper-app, published on 12 May 2026."},"fix_prompt":"MAL-2026-3682 is a malicious package: @chahuadev/junk-sweeper-app (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-3682/ (Markdown: https://insights.sbomify.com/MAL-2026-3682/index.md)","id":"MAL-2026-3682","markdown":"https://insights.sbomify.com/MAL-2026-3682/index.md","name":"MAL-2026-3682","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The package's postinstall script (package.json line 10: \"postinstall\": \"node install.js\") unconditionally fetches a platform-native executable from https://pub-419d22521da042dfb27d1f404b3eb8a6.r2.dev/Junk-Sweeper.exe or /Junk-Sweeper.AppImage, writes it into the package's bin/ directory, and chmods it 0755 on Linux (install.js lines 10, 14-22, 30-67). No SHA-256, signature, or size verification is performed, and HTTP redirects are followed blindly. The package's bin entrypoint (index.js line 32) then spawnSync's the downloaded binary with the user's argv and inherited stdio, giving the bucket owner a persistent, mutable remote-code-execution channel into any installer machine. The hosting domain is an opaque object-storage bucket, not a versioned release artifact from a transparent source (GitHub Releases with tag pinning, npm registry, etc.). Whether or not the current binary contents are malicious, the delivery mechanism allows the content to be swapped at any time without any version change to the npm package.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in @chahuadev/junk-sweeper-app (npm)","id":"MAL-2026-3682","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"@chahuadev/junk-sweeper-app","purl":"pkg:npm/%40chahuadev/junk-sweeper-app","source":"MAL-2026-3682"}],"products":null,"published":"2026-05-12","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-3682/"}