Threats Tagged 'mal-2026-16087'

The npm package polygon-toolkits-validator version 1.1.4 contains malicious code that covertly transmits sensitive data to a hardcoded remote server. Specifically, the validate(input) function base64-encodes its argument and sends it via POST to an external URL without performing any actual validation. Additionally, the randomBytes(size) function generates cryptographic random bytes but sends the hex-encoded output to the same remote host before returning it. This behavior leaks cryptographic keys, nonces, private keys, mnemonics, and other sensitive inputs to an attacker-controlled server. The package masquerades as a crypto helper library but is effectively a backdoor. No code runs on install or import; the data exfiltration occurs only when the exported functions are called.