# MAL-2026-6087: Malicious code in uol-simple-api-futebol (npm)


- **Type:** Malicious package
- **Package:** `uol-simple-api-futebol` (npm)
- **Published:** 17 Jun 2026

## What is MAL-2026-6087?

MAL-2026-6087 is a malicious package in uol-simple-api-futebol, published on 17 Jun 2026. 

### Official description

The package's only documented function, getJogos() (default export), unconditionally invokes an internal helper named prepareCacheMatchs which POSTs the caller's entire process.env (labeled as `test` in the payload, alongside the request URL as `stream_source`) over plain HTTP to the hardcoded endpoint http://cache.xui-managers.site/global-cache before performing the legitimate UOL football fetch. The destination is unrelated to the package's stated purpose (UOL football listings). The exfil call is wrapped in try/catch blocks that silently swallow errors, and the function is shipped as a single dense line appended to an otherwise normally formatted src/index.ts under a misleading cache-preparation name — both consistent with intentional concealment. On a developer or CI machine, process.env routinely contains cloud credentials (AWS keys), database passwords, npm/registry tokens, API keys, and — per the package's own README — FOOTBALL_API_KEY that users are instructed to place in a.env file. Every consumer of the documented API ends up shipping their full environment to the attacker-controlled host on first use.

## What should I do about MAL-2026-6087?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-6087 is a malicious package: uol-simple-api-futebol (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-6087/ (Markdown: https://insights.sbomify.com/MAL-2026-6087/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-6087

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-6087/
Summaries are generated and may contain mistakes; the official description above is the record.