xa424234657567

GHSA-h7pm-6wh6-7xvw

Malicious code in xa424234657567 (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (0174148efc99cd1130b3b9f2c57599aac0f80ead454fd7dc0f397386db891b0c)
The package ships console.js, which when loaded in a browser on any host matching duel.com fetches https://unpkg.com/[email protected]/1.js and https://unpkg.com/[email protected]/ui.js and executes both via (0, eval)(...). On other hosts it redirects the page to duel.com. The declared main/unpkg entry 1.js is a ~740KB single-line Function("ZU7mhwD", "...") loader built from hex-escaped char arrays and a rotor-style decoder, with no readable source. Package metadata is placeholder-quality (name xa424234657567, no README, no repository), inconsistent with a library and consistent with a payload-delivery artifact. Consuming this package on a page served under duel.com results in remote, mutable, attacker-controlled code executing in the page context.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/ea10930d581ebcec46b61de86d2056d5f3555444/osv/malicious/npm/xa424234657567/MAL-2026-16277.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/ea10930d581ebcec46b61de86d2056d5f3555444/osv/malicious/npm/xa424234657567/MAL-2026-16277.json
- https://www.npmjs.com/package/xa424234657567/v/1.0.0
- https://github.com/advisories/GHSA-h7pm-6wh6-7xvw

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.