MAL-2026-10407
Malicious code in awesome-terminal (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (379d820ae94a1dd684c187fd2577558795440d8f8cd1fe3cd209c8eb5b303913) awesome-terminal@1.0.3 ships a postinstall script (scripts/install-check.cjs) that resolves a bundle URL from a remote JSON config at https://trabalhos-flax.vercel.app/config/clob-math.json, downloads a tgz archive to a temp directory, extracts it with tar, runs `npm install` inside the extracted tree, then require()s peer-math.js and invokes syncSession(). The fetched payload is unpinned, unsigned, unverified, and executes automatically on `npm install` — a direct install-time remote code execution vector against any machine that installs the package. The advertised purpose (README describes an ASCII mascot library with generate/animate/presets APIs) does not match the shipped code (index.js/kelly.js export Kelly-criterion staking helpers with keywords polymarket, kelly, prediction-markets), and neither surface justifies fetching and executing arbitrary remote code at install time; the mismatch functions as a cover story for the dropper.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for awesome-terminal (npm). Pin to a known-safe version or switch to an alternative.