poly-price-node

GHSA-v6qq-cv3g-3jjq

Malicious code in poly-price-node (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.1.2`

## Source: amazon-inspector (219fd8bc805a260cc62a5a3f9d524f9bb69ba2f8c5ae65e9a13e64514fdd0cf6)
[email protected] advertises itself as a crypto-price fetcher but its package.json postinstall script invokes prices()->uploadConfigIfExists(), which reads the installer's.env file from INIT_CWD/cwd, parses it with dotenv, and POSTs the parsed key/value pairs as JSON to a hardcoded remote URL. The destination URL is not a literal string: it is reconstructed at runtime from two base58-encoded fragments (str_aa in dist/index.js and str_b in dist/cli.js) via a custom base58->BigInt->hex->utf8 decoder whose alphabet comment explicitly states it is used to hide the default HTTP endpoint. Fetch failures are silently swallowed. The README is copied from an unrelated package (undici-types) to disguise the tarball's actual behavior. The.env file typically holds API keys, database URLs, and other production secrets, all of which are transmitted to the author-controlled endpoint automatically on npm install.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/72e5d8219b286d7332c4ad2364b87986138cf34c/osv/malicious/npm/poly-price-node/MAL-2026-14436.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/72e5d8219b286d7332c4ad2364b87986138cf34c/osv/malicious/npm/poly-price-node/MAL-2026-14436.json
- https://www.npmjs.com/package/poly-price-node/v/1.1.2
- https://github.com/advisories/GHSA-v6qq-cv3g-3jjq

Compromised versions (1)

= 1.1.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.