tick-forge @11.5.2
Vulnerability report · Last retrieved from osv.dev August 6, 2026 at 7:08 PM UTC
OSV ID
MAL-2026-13385
Ecosystem
npm
Summary
The package's default export getPlugin fetches JSON from a hardcoded bare-IP endpoint (http://31.97.137.157:45000/icons/107) and passes the returned data.credits string to new Function(...) invoked with require , module , process , Buffer , Promise , and other Node globals injected. Any consumer calling the default export executes attacker-controlled code inside their Node process with full runtime capabilities. The loader is disguised with icon/CDN naming (IconProvider, iconDomain, a font-awesome-style path, a bearrtoken: "logo" header) while the actual network destination is a bare IP over plain HTTP and the response body is compiled as JavaScript.
Source: amazon-inspector (ea28965c8e98731dba705fb8041ace7efa74984f5a78da68a450c07ef810c6af)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.