vexium-kit @10.0.2
Vulnerability report · Last retrieved from osv.dev August 14, 2026 at 2:31 AM UTC
OSV ID
MAL-2026-13963
Ecosystem
npm
Summary
On require, index.js issues an HTTPS request to the hardcoded bare-IP endpoint https://31.97.137.157:45000/icons/116 and passes the response's credits field to new Function('require','module',...,'Promise', data.credits) , executing operator-controlled JavaScript with require , process , and Buffer in scope. The remote-eval sink is named getPlugin , accompanied by an unused setDefaultModule decoy referencing font-awesome CDN paths, while the README advertises the package as a zero-dependency utility toolkit. Declared dependencies ( @primno/dpapi , better-sqlite3 , sqlite3 , node-machine-id ) match the toolkit shape used to decrypt Chromium DPAPI-protected cookies/passwords and read browser Login Data databases, indicating the operator-supplied payload's intended follow-on capability against the installer.
Source: amazon-inspector (81256cad9a270a808ce5e9cb2d6987aef06c2c236baa7ae76b8172c40ee61dd9)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.