Skip to main content

Boteraser | Website and Server Security Solutions

🛡️ MAL-2026-4682 — tango-app-api-trax

⚪ Unknown ✅ No Known Exploit OSV
N/A
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

Malicious code in tango-app-api-trax (npm)

Source: amazon-inspector

The tarball contains live, importable credentials for systems other than the installer's own. src/controllers/internalTrax.controller.js hardcodes Lenskart POS authentication (username tango.eye, password 55eyetango123, header X-Lenskart-API-Key: valyoo123) inside the exported controllers aomupdateCollection and saleUpdateCollection, which post to webservice.pos.lenskart.com and central.pos.lenskart.com. Any consumer of this npm package can use these credentials to authenticate to Lenskart's production POS API as the tango.eye partner and read or mutate employee/store data. Additionally, fir-51e77-firebase-adminsdk-x3sdp-fd902b74ae.json ships a complete Google Cloud service account (project_id: tango-trax, client_email: [email protected]) including the BEGIN PRIVATE KEY block, granting Firebase Admin privileges over the tango-trax GCP project to anyone who pulls the package. There are no install-time lifecycle hooks; the harm is the redistribution of usable third-party credentials, not auto-execution. The ping matches in the static analysis are unrelated string occurrences in the controller and not exfiltration behavior.

Affected software

MAL-2026-4682 is recorded against 1 package.

  • tango-app-api-trax

Timeline and source

Published on 20 May 2026 and last revised on 26 June 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)
www.npmjs.com (Package)

Details

Severity Unknown
CVSS Score N/A
CVSS Vector N/A
CWE N/A
Public Exploit ✅ No
Source OSV
Published 2026-05-20
Updated 2026-08-20
Modified 2026-06-26
Fix URL N/A

Affected Packages

Software From version Fixed in
tango-app-api-trax

Free Vulnerability Check

Is your site affected by MAL-2026-4682?

BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against MAL-2026-4682 and other known CVE records.

Scan My Site Free →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.

Browse related advisories

All advisoriesMalicious packagesMalicious packages 2026