MAL-2026-15551
Malicious code in date-fns-sync (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (8de9cc36a8817e94d67a46762e62e00a58e17077691ea1b4f649bc1f0d49e967) package.json declares scripts.postinstall = 'node index.js'. index.js reconstructs a URL from a String.fromCharCode integer array — decoding to https://kongregate-api-config.vercel.app/ — fetches JSON from that endpoint, and passes the returned 'token' field directly to eval(). This executes attacker-controlled JavaScript on the installer's machine at npm install time. The destination is not a package publisher domain, the fetched payload is opaque and mutable, and the URL is deliberately concealed via char-code assembly to evade static analysis. The package's README describes it as a caching module, which does not match the observed behavior.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for date-fns-sync (npm). Pin to a known-safe version or switch to an alternative.