# MAL-2026-6708: Malicious code in zyncmap (npm)


- **Type:** Malicious package
- **Package:** `zyncmap` (npm)
- **Published:** 1 Jul 2026

## What is MAL-2026-6708?

MAL-2026-6708 is a malicious package in zyncmap, published on 1 Jul 2026. 

### Official description

zyncmap@0.0.0 advertises itself as an SVG sanitization/minification utility, but index.js exports an undocumented function getPlugin() that, when invoked, performs an HTTP GET against the anonymous paste host https://www.jsonkeeper.com/b/3P9BF and passes the response's `model` string field directly to eval(). Content at that paste URL is attacker-mutable, so any consumer that calls the exported getPlugin() executes arbitrary attacker-controlled JavaScript in the installer's Node.js process. The README and ~80% of index.js implement plausible SVG helpers as cover; the remote-fetch+eval export and a misleading `bearrtoken: "logo"` header are appended separately and not mentioned in package documentation. This is a backdoor: a hidden code path giving the publisher persistent remote code execution against any consumer who reaches the export.

## What should I do about MAL-2026-6708?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-6708 is a malicious package: zyncmap (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-6708/ (Markdown: https://insights.sbomify.com/MAL-2026-6708/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-6708

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-6708/
Summaries are generated and may contain mistakes; the official description above is the record.