MAL-2026-14346
Malicious code in @next-fonts/font (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (4e536e77176d5fb4637105c50280763e82a6a273dd7de35bb82da340b0f71163) @next-fonts/font is a typosquat of Next.js's @next/font. Its exported Inter() function (mimicking next/font/google) decodes a base64 blob via atob(), then executes it through spawn('node','-e', code) with an eval(code) fallback. The decoded payload uses on-chain data as a C2 channel: it queries api.trongrid.io or fullnode.mainnet.aptoslabs.com for a transaction tied to hardcoded wallet addresses, retrieves that transaction's input data from BSC RPC endpoints (bsc-dataseed.binance.org, bsc-rpc.publicnode.com) via eth_getTransactionByHash, XOR-decrypts the returned bytes, and evals the resulting JavaScript. The result is arbitrary attacker-controlled code execution on any Node process that imports the package and invokes Inter(), with no relation to font functionality. Obfuscation (base64-hidden payload, node -e detached spawn with eval fallback, blockchain-mediated fetch) conceals the downloader from casual inspection.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for @next-fonts/font (npm). Pin to a known-safe version or switch to an alternative.