{"answers":{"affected":"1 open source package ship an affected version, including monade.","exploited":"There is no known exploitation of MAL-2026-4613 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-4613 is a malicious package in monade, published on 26 May 2026."},"fix_prompt":"MAL-2026-4613 is a malicious package: monade (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-4613/ (Markdown: https://insights.sbomify.com/MAL-2026-4613/index.md)","id":"MAL-2026-4613","markdown":"https://insights.sbomify.com/MAL-2026-4613/index.md","name":"MAL-2026-4613","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"monade@0.0.7 advertises itself as a JavaScript monad/flow utility library (cjs/index.js exports flow, of, opt, ka, dev), yet ships a 976KB UPX-packed Linux x86-64 ELF at src/compiler/native and wires it directly to the npm preinstall lifecycle hook (package.json: \"preinstall\": \"./src/compiler/native\"). On every `npm install` on Linux, this opaque native binary executes with the installer's privileges before any of the package's JavaScript is even evaluated. The binary is deliberately obfuscated via UPX packing (signature \"http://upx.sf.net\" present in the file) and unpacked strings reveal HTTP client primitives (HTTP/1.1, POST, DELETE, XMLHttp), HTTPS URLs, environment-variable access, eBPF references, and anti-debug indicators — none of which are needed for a pure-JS utility library. The package ships no C/C++/Rust source, no binding.gyp, no build system; the binary is not the product of a compile step but a prebuilt opaque payload. This is the canonical install-time dropper shape: arbitrary attacker-controlled native code executed on the installer's machine on `npm install`, with cover-story naming (\"compiler/native\") that contradicts the package's advertised purpose.\n\nThis package was compromised as part of the IronWorm campaign. This campaign executes a malicious binary payload during installation via a preinstall hook. The payload is a Rust-built infostealer that targets developer environments, scanning for and harvesting credentials related to cloud providers, object storage, databases, source-control, package registries, and AI developer tools. It also targets cryptocurrency wallets, specifically injecting a malicious JavaScript hook into the Exodus desktop wallet to capture passwords and recovery phrases. Furthermore, the malware exhibits worm-like behavior by stealing GitHub and NPM credentials to push malicious updates to the victim's repositories and publish trojanized packages, and it uses an eBPF-based kernel rootkit to hide its processes and network connections on Linux systems.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in monade (npm)","id":"MAL-2026-4613","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"monade","purl":"pkg:npm/monade","source":"MAL-2026-4613"}],"products":null,"published":"2026-05-26","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-4613/"}