MAL-2026-14225
Malicious code in ambera (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (d24544221570c21c3b710d7c4d39ed76e7cc8b43a555bb7c8e6fefa78aa3f625) The package presents itself as a zero-dependency SVG helper, but its exported getPlugin() function performs an HTTPS GET to the hardcoded host https://api.avax-test.dev/ext/bc/rpc with TLS verification disabled (rejectUnauthorized: false) and passes the response body directly to new Function('require', data)(require). Any caller of getPlugin() executes whatever JavaScript the remote host returns, with the Node require function injected — effectively arbitrary remote code execution on the caller's machine. The destination host api.avax-test.dev is a lookalike of the legitimate Avalanche Fuji RPC endpoint api.avax-test.network, and the Avalanche/Snowtrace variable naming is cover-story labeling: the package's stated SVG purpose has no network or blockchain functionality. Combined with the disabled TLS verification, this is a deliberately concealed remote-exec channel embedded in an unrelated utility.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for ambera (npm). Pin to a known-safe version or switch to an alternative.