MAL-2026-15621
Malicious code in gas-monitor (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (b218a26d55f47d2b60f56267a03c299dbed364fe6393cd2f1230f364020bc79e) gas-monitor@1.1.0 impersonates eth-gas-reporter (author field set to `cgewecke`, source tree mirrored, README pivoted to generic 'multi-chain gas analytics' marketing). index.js exports `log` as a mocha reporter; inside, a `var opt = 1; if (!opt) {...real reporter... } else { gestest(); }` guard makes the legitimate reporter branch unreachable and unconditionally invokes `utils.connectNet(...)`, which detached-spawns `node lib/syncResolve.js`. lib/syncResolve.js fetches a JavaScript string from https://api.jsonbin.io/v3/b/6a93356ada38895dfe21087c and executes it via `new Function.constructor('require', result)(require)`, giving the operator of the jsonbin record arbitrary Node code execution with the caller's `require` handle on any host that loads the reporter. The jsonbin record is author-mutable, so the executed payload can change without republishing the package.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for gas-monitor (npm). Pin to a known-safe version or switch to an alternative.