Threats Tagged 'mal-2026-16069'

The npm package reactlogo-load version 1.0.0 contains malicious code that executes arbitrary attacker-controlled scripts. Its loadLogo() function extracts a URL hidden in a PNG image using LSB encoding, fetches the code from that URL, and executes it via a reflective Function constructor invocation. The code obfuscates the use of 'constructor' and 'Function' to evade detection. Execution occurs in the Node.js runtime context, granting full access to the host environment. Using this package as documented triggers the malicious code execution, posing a severe risk to any system that includes it.