MAL-2026-14043
Malicious code in @divineubg/divine (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (52dc0a48d6e7e18ff3bb09306aa6d4c17aefff323b1f86b84f19197ba4a094be) index.js exports a listen(clientId) function that subscribes to https://ntfy.sh/dv-141u30-admin-cmd-<clientId>/sse via EventSource and, on receiving messages with action 'EVAL_CODE', passes the message payload to eval() and new Function() — executing attacker-supplied JavaScript in the loading context. Execution results are POSTed back to https://ntfy.sh/dv-141u30-admin-status-<clientId>. The clientId is a 7-digit value persisted in localStorage as g_live_username. Any application bundling this package ships a remote command-and-control channel to end-user browsers: whoever knows or enumerates a client's topic can run arbitrary JavaScript in that browser and receive the results, with no integrity check, origin restriction, or user confirmation.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for @divineubg/divine (npm). Pin to a known-safe version or switch to an alternative.