# MAL-2026-4528: Malicious code in cloud-pc-templates (npm)


- **Type:** Malicious package
- **Package:** `cloud-pc-templates` (npm)
- **Published:** 20 May 2026

## What is MAL-2026-4528?

MAL-2026-4528 is a malicious package in cloud-pc-templates, published on 20 May 2026. 

### Official description

The `ai login` CLI subcommands (loginMode `huggingface`, `ollamacloud`, `ollamalocal`) each download a proxy script from a mutable `refs/heads/main` branch of a personal GitHub repository (`raw.githubusercontent.com/devashish234073/cloud-pc-templates-marketplace/refs/heads/main/JS-PROXIES/{hf-proxy.js,ollama-proxy.js,ollamaoffline-proxy.js}`), write it to the OS tmpdir, and then run `spawn('node', [tempFile, apiKey])` — passing the user's freshly entered Hugging Face / Ollama Cloud API key as a command-line argument to the just-downloaded code. There is no commit pin, no tag, no checksum, and no signature verification. Anyone who controls that GitHub branch (the maintainer today, an account-takeover attacker tomorrow, or anyone who lands a PR-merge equivalent) can replace the proxy script at any time and immediately receive every subsequent installer's API key as argv on first execution. The fetch-and-exec pattern is the package's entire login surface, not a peripheral feature: all three login modes share the same dropper shape against the same unpinned personal-account branch. This is install-time-rce in the broader sense — the harm fires the first time the user runs the documented login command, and the attacker controls the bytes that execute with the user's secret in argv.

## What should I do about MAL-2026-4528?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-4528 is a malicious package: cloud-pc-templates (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-4528/ (Markdown: https://insights.sbomify.com/MAL-2026-4528/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-4528

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-4528/
Summaries are generated and may contain mistakes; the official description above is the record.