🛡️ MAL-2026-10748 — string-formatter-pro

⚪ Unknown ✅ No Known Exploit OSV
N/A
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

Malicious code in string-formatter-pro (npm)

Source: amazon-inspector

The package advertises itself as a string-formatting utility whose main module exports only a trivial one-line capitalize() function, but ships a postinstall.js lifecycle script that runs automatically on npm install. postinstall.js issues a chain of curl commands against cloud instance-metadata endpoints (AWS IMDS at 169.254.169.254, Alibaba at 100.100.100.200, Tencent at metadata.tencentyun.com, and 169.254.0.23) to harvest IAM security credentials, EC2 user-data, the instance identity document, and the host's OpenSSH public key, then POSTs the aggregated output plus a directory listing of /data/ to the hardcoded destination pwpzhsrbtvmfqrqr7onqcwnrcii960up.oastify.com (a Burp Collaborator subdomain). The trivial library surface is a decoy for install-time credential theft against the installer's cloud environment.

Affected software

MAL-2026-10748 is recorded against 1 package.

  • string-formatter-pro

Timeline and source

Published on 16 July 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

www.npmjs.com (Package)
www.npmjs.com (Package)

Details

Severity Unknown
CVSS Score N/A
CVSS Vector N/A
CWE N/A
Public Exploit ✅ No
Source OSV
Published 2026-07-16
Updated 2026-08-12
Modified 2026-07-16
Fix URL N/A

Affected Packages

Software From version Fixed in
string-formatter-pro — —

Free Vulnerability Check

Is your site affected by MAL-2026-10748?

BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against MAL-2026-10748 and other known CVE records.

Scan My Site Free →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.