# MAL-2026-4572: Malicious code in get-package-lint (npm)


- **Type:** Malicious package
- **Package:** `get-package-lint` (npm)
- **Published:** 22 May 2026

## What is MAL-2026-4572?

MAL-2026-4572 is a malicious package in get-package-lint, published on 22 May 2026. 

### Official description

Package name typosquats the popular `get-package-type` and reuses its README/exports verbatim, but adds `"postinstall": "node utils.cjs"` in package.json. utils.cjs is a 263 KB obfuscator.io-protected blob (string-array rotation with anti-debug `debugger` loops, RegExp toString fingerprint, and `Function('return this')` sandbox checks) that on `npm install`: (1) decodes a hardcoded base64+XOR-obfuscated URL and bearer token (HF_TOKEN), (2) HTTPS-GETs a platform-specific binary (linux-x64 / darwin-arm64 / win32-x64 selected via DOWNLOAD_MAP), (3) writes it under the user's local data directory, `chmod 0755` on POSIX, and spawns it detached, (4) installs OS-level persistence: on Windows via `reg add HKCU\...\CurrentVersion\Run`, on macOS via a LaunchAgent plist under `~/Library/LaunchAgents`, on Linux via a systemd user unit at `~/.config/systemd/user/<unit>.service` followed by `systemctl --user daemon-reload && enable && start`. The script also self-detaches by re-spawning itself with a `child` argv via `{detached:true, stdio:'ignore'}` and calling `process.exit(0)` so npm sees success while the dropper continues asynchronously. The fetched bytes are opaque, unverified (no hash/signature), and the source domain is not the package's publisher. This is an unambiguous binary-runner-dropper plus backdoor persistence triggered on every install.

## What should I do about MAL-2026-4572?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-4572 is a malicious package: get-package-lint (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-4572/ (Markdown: https://insights.sbomify.com/MAL-2026-4572/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-4572

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-4572/
Summaries are generated and may contain mistakes; the official description above is the record.