{"answers":{"affected":"1 open source package ship an affected version, including decimal-format-core.","exploited":"There is no known exploitation of MAL-2026-6689 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-6689 is a malicious package in decimal-format-core, published on 30 Jun 2026."},"fix_prompt":"MAL-2026-6689 is a malicious package: decimal-format-core (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-6689/ (Markdown: https://insights.sbomify.com/MAL-2026-6689/index.md)","id":"MAL-2026-6689","markdown":"https://insights.sbomify.com/MAL-2026-6689/index.md","name":"MAL-2026-6689","record":{"aliases":["GHSA-jpc6-jpfr-f453"],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. `decimal-format-core` uses a dropper technique: a `postinstall` hook executes `scripts/install-check.cjs` at install time, which fetches a second-stage infostealer payload from the C2 domain `logstream-api.online`. The infostealer harvests cryptocurrency wallet vaults (MetaMask, Phantom, Solflare, OKX, Coinbase, TrustWallet, Backpack, TronLink), Chrome/Firefox/Brave cookies and credentials, SSH keys, AWS credentials, `.npmrc` tokens, Docker config, shell history, and password manager databases, then exfiltrates the data to the attacker-controlled server.\n\nPackage advertises itself as a numeric/text formatting utility but ships an install-time and import-time dropper. The `postinstall` script runs `scripts/install-check.cjs`, which reads `package.json.homepage` (`https://logstream-api.online/config/dfc-sync.json`) as a remote configuration channel, fetches a `.tgz` bundle URL from that JSON, downloads and extracts the tarball into a `.peer/` directory, runs `npm install` inside it, then `require()`s the extracted `peer-math.js` and invokes `syncSession()` — executing arbitrary attacker-controlled JavaScript on the installer's machine. The same fetch → extract → npm-install → require flow is also queued via `setImmediate` from the exported `createLogger()` entrypoint (through `runRuntimeProjectSync()` calling `peer.packProjectBundle(false)`), so consumers that install with `--ignore-scripts` still trigger remote code execution as soon as the library is imported and used. Payload URL indirection through the remote JSON config allows rotation of the executed code without republishing the npm package. The advertised formatting functionality does not require any network access, tarball extraction, or dynamic loading of downloaded modules.\n\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in decimal-format-core (npm)","id":"MAL-2026-6689","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":["0"],"last_affected":[],"package":"decimal-format-core","purl":"pkg:npm/decimal-format-core","source":"MAL-2026-6689"}],"products":null,"published":"2026-06-30","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-6689/"}