MAL-2026-14288
Malicious code in @wizloft/harness-plugin-repository-files (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (d8197c156f5877fb7a024a3007bed2da30176f74960e3fa271cac4c4369f2705) dist/index.js of @wizloft/harness-plugin-repository-files ships a small legitimate wizloft-harness repository-files plugin followed at line 209 by a ~35KB obfuscator.io-packed IIFE (303-entry rotated string array _0x240a with decoder _0x4963, control-flow flattening, hex-named identifiers). Decoded strings in the appended segment include Ethereum JSON-RPC and block-explorer endpoints (drpc.org, publicnode.com, blockscout, an etherscan-style txlist/account API), a hardcoded mixed-case ETH address prefix 0xa322E5f3..., a forged Chrome User-Agent, brotli/gzip decompression, AbortController-based fetch, and a custom /0x/ls exfil path with x-payload-* headers. The payload runs at module load whenever a consumer imports the package and has no relationship to the advertised purpose of reading repository files for a harness runtime. Only the trailing segment is obfuscated; the legitimate plugin portion is plain ESM, indicating a hostile payload smuggled onto an otherwise-clean plugin build.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for @wizloft/harness-plugin-repository-files (npm). Pin to a known-safe version or switch to an alternative.