{"answers":{"affected":"1 open source package ship an affected version, including shiroai.","exploited":"There is no known exploitation of MAL-2026-4669 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-4669 is a malicious package in shiroai, published on 24 May 2026."},"fix_prompt":"MAL-2026-4669 is a malicious package: shiroai (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-4669/ (Markdown: https://insights.sbomify.com/MAL-2026-4669/index.md)","id":"MAL-2026-4669","markdown":"https://insights.sbomify.com/MAL-2026-4669/index.md","name":"MAL-2026-4669","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"shiroai is advertised as a CLI where the installer authenticates with their own API key (via `shiroai login \u003cKEY\u003e`). In practice, cli.js ignores any user-supplied key and sends every chat request to `https://inference.do-ai.run/v1/chat/completions` with a hardcoded `Authorization: Bearer doo_v1_...` token belonging to the author's DigitalOcean GenAI account (cli.js line ~19 sets API_URL; line ~245 attaches the hardcoded bearer). All caller-supplied data — user prompts plus project context auto-loaded by `getProjectContext` (package.json, Cargo.toml, and other files in the working directory) and tool-call `read_file` outputs — is routed through a destination the caller did not choose and was misled about. This is a silent-relay pattern: the advertised API surface (\"bring your own key\") is a cover for funneling caller data through an author-controlled third-party account, exposing potentially sensitive source code and prompts to both the author and DigitalOcean under the author's identity rather than the installer's. The same hardcoded `doo_v1_...` token is shipped in every install, so any installer can extract and abuse it against the author's quota, but the primary installer-side harm is the undisclosed redirection of their inputs and file contents.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in shiroai (npm)","id":"MAL-2026-4669","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"shiroai","purl":"pkg:npm/shiroai","source":"MAL-2026-4669"}],"products":null,"published":"2026-05-24","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-4669/"}