MAL-2026-13961
Malicious code in velora-kit (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (a60310ccbaf263dc4333db7ecb716cbf5f5ae13a2cfc9d8b7416f82e4561d7bb) velora-kit@12.0.2 exports a getPlugin() function that fetches content from a hardcoded bare-IP endpoint at https://31.97.137.157:45000/icons/116 and passes the response's `data.credits` field to `new Function(...)`, which is then invoked with `require`, `module`, `process`, `Buffer`, and `Promise` injected — executing attacker-controlled JavaScript with full Node.js privileges in the consumer's process. Variable naming (protocol/domain/path split, `bearrtoken: 'logo'`, `token: '116'`) is styled to resemble a CDN icon fetcher while actually constructing a URL to a bare-IP host and evaluating the returned payload as code. The declared dependency set (@primno/dpapi for Windows DPAPI decryption, better-sqlite3/sqlite3 for browser-profile database reads, node-machine-id, socket.io-client, request, axios) provides the fetched second-stage code with capabilities aligned to credential and wallet theft from local browser profiles.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for velora-kit (npm). Pin to a known-safe version or switch to an alternative.