{"items":[{"id":"NVI-00011137","kind":"supply_chain_event","title":"Malicious code in mfahelper (npm)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-vxqj-q8pf-p87h"],"plain_summary":"GitHub lists this malware advisory for mfahelper. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-ea1658eb3e770c29240014f378f6a4b6"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-ea1658eb3e770c29240014f378f6a4b6","url":"https://github.com/advisories/GHSA-vxqj-q8pf-p87h","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-vxqj-q8pf-p87h","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T23:13:53.199Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-ea1658eb3e770c29240014f378f6a4b6"],"technology":"mfahelper","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (e6df54a49845aa55e3310261ccc7002fe5aabcdf3924875bf7c1ad3fb4751297)\npackage.json declares its only runtime dependency, `node-net-pool`, as an https tarball pointing at the `main` branch of an unrelated GitHub account (`https://github.com/trktgq0wbre1/node-net-pool/archive/refs/heads/main.tar.gz`) — no version pin, no commit SHA, no integrity hash. `npm install` fetches whatever bytes currently live at that mutable URL and executes any lifecycle scripts they contain on the installer's machine. In addition, lib/cache.js runs `module.require('node-net-pool')` inside a swallowed try/catch at top level, so the third-party payload also loads when a consumer `require()`s the package, extending the code-execution surface beyond install time to any downstream import. The account owning the tarball URL is unrelated to the package publisher, so whoever controls that branch controls arbitrary code delivered to every installer.\n\n---\n\nCredit: OpenSSF (source)","public_affected_ranges":["= 1.0.0"]}],"null_published_at":"2026-10-31T23:18:22.434Z","source_updated_at":"2026-09-30T03:31:52.000Z","source_disclosed_at":"2026-09-30T03:31:46.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T23:13:53.199Z"}],"next_cursor":null,"snapshot_revision":"42594"}