Malicious code in font-huge (npm)
The npm package font-huge version 2.5.3 contains malicious code that executes attacker-controlled JavaScript with full Node.js privileges when its default export is called. It fetches a script from an unrelated external domain and evaluates code from the response, enabling potential credential theft. The package declares dependencies related to credential stealing but does not use them in legitimate code, indicating malicious intent.
AI Analysis
Technical Summary
The font-huge npm package version 2.5.3 exports a getPlugin function that fetches data from a suspicious external URL (https://svganchordev.net/icons/107). It extracts the 'credits' field from the response and executes it using the JavaScript Function constructor with Node.js primitives injected, allowing arbitrary code execution with full Node privileges. The package's declared dependencies align with those used by browser credential stealers but are unused in the shipped code. Error handling suppresses fetch failures, obscuring malicious activity. This behavior constitutes a supply chain attack via a malicious npm package.
Potential Impact
Any project importing and invoking the default export of font-huge version 2.5.3 risks executing arbitrary attacker-controlled code with full Node.js privileges. This can lead to credential theft, data exfiltration, and compromise of the host environment. The malicious code is designed to evade detection by suppressing errors and obfuscating the malicious URL.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately cease using font-huge version 2.5.3 and remove it from their projects. Avoid importing or executing code from this package. Monitor for updates or advisories from the package maintainers or npm security teams for remediation guidance. Consider using alternative trusted packages for font/icon collections.
Malicious code in font-huge (npm)
Description
The npm package font-huge version 2.5.3 contains malicious code that executes attacker-controlled JavaScript with full Node.js privileges when its default export is called. It fetches a script from an unrelated external domain and evaluates code from the response, enabling potential credential theft. The package declares dependencies related to credential stealing but does not use them in legitimate code, indicating malicious intent.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The font-huge npm package version 2.5.3 exports a getPlugin function that fetches data from a suspicious external URL (https://svganchordev.net/icons/107). It extracts the 'credits' field from the response and executes it using the JavaScript Function constructor with Node.js primitives injected, allowing arbitrary code execution with full Node privileges. The package's declared dependencies align with those used by browser credential stealers but are unused in the shipped code. Error handling suppresses fetch failures, obscuring malicious activity. This behavior constitutes a supply chain attack via a malicious npm package.
Potential Impact
Any project importing and invoking the default export of font-huge version 2.5.3 risks executing arbitrary attacker-controlled code with full Node.js privileges. This can lead to credential theft, data exfiltration, and compromise of the host environment. The malicious code is designed to evade detection by suppressing errors and obfuscating the malicious URL.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately cease using font-huge version 2.5.3 and remove it from their projects. Avoid importing or executing code from this package. Monitor for updates or advisories from the package maintainers or npm security teams for remediation guidance. Consider using alternative trusted packages for font/icon collections.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-10492
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a55ff9e68715ace432f6ba5
Added to database: 07/14/2026, 09:21:34 UTC
Last enriched: 07/14/2026, 09:52:27 UTC
Last updated: 07/28/2026, 11:03:40 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.