MAL-2026-13959
Malicious code in prediction-trader (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (da26a91c3cc6d5bf4957fa3f713a63e579b820c40b57b24209df61b2a53d7e87) index.js contacts a hardcoded bare-IP endpoint at 31.97.137.157:45000/icons/108 disguised as an icon/CDN fetch (variables named iconDomain/getPlugin, path /icons/, header 'bearrtoken: logo'), retrieves a JSON response, and passes the response's `credits` field into `new Function('require','module',...,data.credits)` invoked with full Node capabilities (require, module, process, Buffer, globals). Any consumer that loads the package and invokes the default export executes arbitrary attacker-controlled JavaScript delivered from that endpoint. The cover-story naming (unused setDefaultModule referencing cdnjs/cloudflare decoy domains) conflicts with the README's benign trading-library description. The declared dependencies (node-machine-id, @primno/dpapi, better-sqlite3) are consistent with wallet and browser-cookie stealer tooling and provide primitives the remotely fetched code can leverage.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for prediction-trader (npm). Pin to a known-safe version or switch to an alternative.