MAL-2026-13939
Malicious code in @leonardo0902/vortex-kit (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (1707e031a6c470479ecbd0b01a480cc801a9d049a3732abc265ccad8791272a9) The main module in @leonardo0902/vortex-kit@12.0.2 issues an HTTPS request to a hardcoded bare-IP endpoint at 31.97.137.157:45000/icons/116 and passes the returned `credits` field to `new Function('require',..., 'Promise', data.credits)`, executing attacker-controlled JavaScript with full Node context (require, process, Buffer) whenever the module is loaded and its exported function is invoked. The fetch destination is disguised as a static-asset endpoint: the file defines a decoy `setDefaultModule` referencing legitimate CDNs (cloudflare, fastly, akamai, cloudfront) and a font-awesome path, then reuses the identical variable names (`protocol`, `domain`, `path`, `head`, `bearrtoken: 'logo'`) around the bare-IP fetch-and-eval to frame it as an icon download. Bundled native dependencies (@primno/dpapi, better-sqlite3, node-machine-id) are consistent with a dynamically delivered browser-credential-stealer payload. The remote code is unpinned, unverified, and controlled entirely by whoever operates the IP.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for @leonardo0902/vortex-kit (npm). Pin to a known-safe version or switch to an alternative.