MAL-2026-16053
Malicious code in file-type-detector (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (04917bd7fc156dcb9793cb1f1d06ed0f2d0cb1b3aa4b04431dea54ed71f6be72) A clone of file-type-checker with one function added: isSign(name, moduleName, offset) in dist/validation/image.js reads public/${name}.png from the working directory, splits the buffer at -offset, and writes the trailing payload to../../../{moduleName}/log - a sibling package under node_modules - then returns isPNG() so the caller sees a plausible boolean. It is undocumented, reachable only via an __exportStar wildcard so it is never named in dist/index.js, and fails silently on try/catch.
Drop stage of a three-package chain: file-type-detector writes the payload, gloggo (1.1.2-1.1.4) executes it via require('./log'), and sonmors (typosquat of sonner) triggers the chain by requiring gloggo. gloggo shares the npm publisher log-developer and was published five minutes apart on 2026-08-27. No install hooks; execution occurs on require().
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for file-type-detector (npm). Pin to a known-safe version or switch to an alternative.