{"answers":{"affected":"1 open source package ship an affected version, including maplibre-gl-vue3.","exploited":"There is no known exploitation of MAL-2026-6592 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-6592 is a malicious package in maplibre-gl-vue3, published on 29 Jun 2026."},"fix_prompt":"MAL-2026-6592 is a malicious package: maplibre-gl-vue3 (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-6592/ (Markdown: https://insights.sbomify.com/MAL-2026-6592/index.md)","id":"MAL-2026-6592","markdown":"https://insights.sbomify.com/MAL-2026-6592/index.md","name":"MAL-2026-6592","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The package advertises itself as MapLibre GL bindings for Vue 3 and re-exports the upstream maplibre-gl API, but on import it unconditionally injects a \u003cscript\u003e tag into document.head pointing at http://121.199.166.250:19527/myApi/pipesnetwork.js. src/index.ts calls loadGuardScript() at module top level; src/license.ts defines GUARD_SCRIPT_URL and appends the script element to document.head. Any Vue 3 application that imports this package will fetch and execute attacker-controlled JavaScript from a hardcoded bare-IP, plaintext-HTTP endpoint in the consumer's browser context — giving the operator of that endpoint full access to cookies, localStorage, session tokens, and user input in the host application. The endpoint is unpinned (no SRI, no version), served over HTTP (mutable in transit), and unrelated to mapping functionality. A source comment ('改这里：发布给第三方前换成你托管的 guard 脚本地址' — 'change this before releasing to third parties: replace with your hosted guard script address') indicates the loader is intended to deliver third-party-controlled code to downstream consumers. The package name also shadows the maplibre-gl ecosystem (legitimate Vue bindings are published as vue-maplibre-gl), increasing the chance of accidental installation.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in maplibre-gl-vue3 (npm)","id":"MAL-2026-6592","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":["0"],"last_affected":[],"package":"maplibre-gl-vue3","purl":"pkg:npm/maplibre-gl-vue3","source":"MAL-2026-6592"}],"products":null,"published":"2026-06-29","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-6592/"}