{"answers":{"affected":"1 open source package ship an affected version, including simple-node-calc-c.","exploited":"There is no known exploitation of MAL-2026-6454 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-6454 is a malicious package in simple-node-calc-c, published on 25 Jun 2026."},"fix_prompt":"MAL-2026-6454 is a malicious package: simple-node-calc-c (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-6454/ (Markdown: https://insights.sbomify.com/MAL-2026-6454/index.md)","id":"MAL-2026-6454","markdown":"https://insights.sbomify.com/MAL-2026-6454/index.md","name":"MAL-2026-6454","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Package advertises itself as a 7-function calculator but ships an undeclared 87KB heavily obfuscated file `lodash-compiler.js` (obfuscator.io string-array packing with rotation and control-flow flattening) that is not referenced from `index.js` or `package.json`. The published `binding.gyp` declares only a benign `noop` target, but the tarball also ships a pre-generated `build/` directory whose top-level Makefile includes `lodash_action.target.mk`, whose `all` target runs `node lodash-compiler.js`. When deobfuscated, the file performs a top-level `require('fs').writeFileSync('poc.txt','Security POC.')` — confirming arbitrary code execution via the build pipeline. The mismatch between the sanitized `binding.gyp` and the shipped Makefile is consistent with build-cache smuggling: a default `npm install` regenerates Makefiles from `binding.gyp` and neutralizes the payload, but `npm rebuild`, `make` invoked directly, or any node-gyp path that reuses cached build output will execute the obfuscated file. The filename impersonates lodash to evade casual review. The current payload writes a marker file, but the delivery mechanism (obfuscated, undeclared, hidden behind a sanitized gyp facade) provides the author with arbitrary code execution on rebuild paths.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in simple-node-calc-c (npm)","id":"MAL-2026-6454","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"simple-node-calc-c","purl":"pkg:npm/simple-node-calc-c","source":"MAL-2026-6454"}],"products":null,"published":"2026-06-25","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-6454/"}