{"id":"MAL-2026-14268","summary":"Malicious code in no-for-of-loops (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (08feaf6617a902e503390720b41d226364ba3bc125d298eb296a2d3e30d5b6d5)\npackage.json declares no-for-of-loops as its own dependency and devDependency, with the source pointed at http://pack.nppacks.com/npm/no-for-of-loops instead of the npm registry. On `npm install`, npm fetches a tarball from this host over unauthenticated plain HTTP with no integrity hash, and installs its contents into the consumer's node_modules. The domain operator can serve arbitrary, mutable bytes on each fetch, meaning any code shipped from that host runs inside the installer's dependency tree. The main module's header additionally self-identifies the package as a 'Security Research Testing Purpose' artifact, and the package description is a bare 'NPM', consistent with a hijack-vector proof-of-concept rather than a functional utility. The auto-execute condition is satisfied: any default `npm install` of this package resolves and installs the attacker-controlled tarball without user opt-in.\n","modified":"2026-08-19T07:00:15.489812188Z","published":"2026-08-19T06:22:58Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018381","import_time":"2026-08-19T06:49:44.39761579Z","modified_time":"2026-08-19T06:22:58Z","sha256":"08feaf6617a902e503390720b41d226364ba3bc125d298eb296a2d3e30d5b6d5","source":"amazon-inspector","versions":["1.0.1"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/no-for-of-loops/v/1.0.1"}],"affected":[{"package":{"name":"no-for-of-loops","ecosystem":"npm","purl":"pkg:npm/no-for-of-loops"},"versions":["1.0.1"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"tlsh":"66f0f60cde21aa5748ca396d99275a42b2767e675818fe1832c7973c0b4d0fb60f929c","path":"package.json","sha256":"9898595aa3e08330461d2cfe9de8412a293420b480b4d51632a0dec4d7b02aa9"},{"path":"index.js","sha256":"f2fcebdb4f0e41365a39ca87a52fcc4e6abd5633fe6272e60d1386d26b90ef41","tlsh":"71a1935ab5e0159745aa22e5b3ce48b577bd80b3330df5a0b54cbf563f40c348a1aed1"}],"package_integrity":[{"filename":"no-for-of-loops-1.0.1.tgz","hashes":{"sha1":"5934f580a9bdda1d499a74a35b4034b04d4af738","sha512_sri":"sha512-zK1v5Nb/8sLnxxB2KS5pyZ9Ja0UIxDfPPJHwoCWMYec0X/sx2iYLIDi+cc7rkGN4Iz4b1lTmZZne1vrhAhdVDg=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/no-for-of-loops/MAL-2026-14268.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}