🛡️ MAL-2026-10717 — onecode
Description
Malicious code in @onescience/onecode (npm)
Source: amazon-inspector
The npm postinstall hook runs ensurePlatformBinary(), which downloads a.tgz archive from the hardcoded bare-IP URL https://218.90.133.98:4443/onecode_tgz/onecode-<ver>/onecode-linux-x64-<ver>.tgz, extracts it via tar -xzf, chmods the extracted file to 0o755, hardlinks it into bin/.onecode, and the shipped CLI launcher invokes it. The HTTPS request explicitly sets rejectUnauthorized: false, disabling TLS certificate verification, and no hash or signature check is performed on the downloaded artifact. The download destination is a bare IPv4 address on a non-standard port, not a publisher-owned domain or a recognized release host. The package name and launcher (@onescience/onecode) mirror the unrelated 'opencode' project — env-var fallbacks reference OPENCODE_BIN_PATH and bundled asset directories are named.opencode/session-seed and.opencode/oneskills — while the executable payload is retrieved from an unrelated hardcoded IP endpoint. Anyone controlling that host, or any on-path network attacker (TLS is disabled), can deliver arbitrary code that executes on every installer's machine.
Affected software
MAL-2026-10717 is recorded against 1 package.
- @onescience/onecode
Timeline and source
Published on 16 July 2026 and last revised on 7 August 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.
References
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
Details
Affected Packages
| Software | From version | Fixed in |
|---|---|---|
| @onescience/onecode | — | — |
References
Free Vulnerability Check
Is your site affected by MAL-2026-10717?
BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against MAL-2026-10717 and other known CVE records.
Scan My Site Free →No credit card required · Results in minutes
ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.
