{"answers":{"affected":"1 open source package ship an affected version, including tempo-shared-modules.","exploited":"There is no known exploitation of MAL-2026-4688 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-4688 is a malicious package in tempo-shared-modules, published on 25 May 2026."},"fix_prompt":"MAL-2026-4688 is a malicious package: tempo-shared-modules (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-4688/ (Markdown: https://insights.sbomify.com/MAL-2026-4688/index.md)","id":"MAL-2026-4688","markdown":"https://insights.sbomify.com/MAL-2026-4688/index.md","name":"MAL-2026-4688","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"On `npm install`, the preinstall script `poc.js` collects host identity (hostname, username, OS/platform), network configuration (ipconfig / ip a / resolv.conf), git remote, the parent project's package.json, CI configuration files (.gitlab-ci.yml,.github/workflows, Jenkinsfile, azure-pipelines.yml), and bulk-scrapes process.env for any variable name matching TOKEN, AWS, AZURE, NPM, GITHUB, GITLAB, CI_, JENKINS, BUILD, or WALMART together with their values. The collected payload is POSTed over HTTPS to the hardcoded interactsh OAST endpoint `d8a5d9pon5bugoc35cngp9hcregcqyezu.oast.me`. The package is published at version 99.0.2 on the public npm registry under a name designed to be resolved by mistake instead of an internal `@livingdesign/react` private package — the canonical dependency-confusion shape. The package's own description self-labels it as a Walmart HackerOne PoC, but it is publicly installable and any non-Walmart installer that resolves it is harmed: their CI tokens, cloud credentials, and pipeline configuration are sent to a third-party OAST callback host. Any one of (preinstall env-credential scrape, hardcoded OAST exfil endpoint, dependency-confusion publication shape) is independently sufficient to block.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in tempo-shared-modules (npm)","id":"MAL-2026-4688","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"tempo-shared-modules","purl":"pkg:npm/tempo-shared-modules","source":"MAL-2026-4688"}],"products":null,"published":"2026-05-25","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-4688/"}