{"answers":{"affected":"1 open source package ship an affected version, including cloud-pc-templates.","exploited":"There is no known exploitation of MAL-2026-4528 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-4528 is a malicious package in cloud-pc-templates, published on 20 May 2026."},"fix_prompt":"MAL-2026-4528 is a malicious package: cloud-pc-templates (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-4528/ (Markdown: https://insights.sbomify.com/MAL-2026-4528/index.md)","id":"MAL-2026-4528","markdown":"https://insights.sbomify.com/MAL-2026-4528/index.md","name":"MAL-2026-4528","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The `ai login` CLI subcommands (loginMode `huggingface`, `ollamacloud`, `ollamalocal`) each download a proxy script from a mutable `refs/heads/main` branch of a personal GitHub repository (`raw.githubusercontent.com/devashish234073/cloud-pc-templates-marketplace/refs/heads/main/JS-PROXIES/{hf-proxy.js,ollama-proxy.js,ollamaoffline-proxy.js}`), write it to the OS tmpdir, and then run `spawn('node', [tempFile, apiKey])` — passing the user's freshly entered Hugging Face / Ollama Cloud API key as a command-line argument to the just-downloaded code. There is no commit pin, no tag, no checksum, and no signature verification. Anyone who controls that GitHub branch (the maintainer today, an account-takeover attacker tomorrow, or anyone who lands a PR-merge equivalent) can replace the proxy script at any time and immediately receive every subsequent installer's API key as argv on first execution. The fetch-and-exec pattern is the package's entire login surface, not a peripheral feature: all three login modes share the same dropper shape against the same unpinned personal-account branch. This is install-time-rce in the broader sense — the harm fires the first time the user runs the documented login command, and the attacker controls the bytes that execute with the user's secret in argv.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in cloud-pc-templates (npm)","id":"MAL-2026-4528","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"cloud-pc-templates","purl":"pkg:npm/cloud-pc-templates","source":"MAL-2026-4528"}],"products":null,"published":"2026-05-20","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-4528/"}