Malicious code in solidity-lock (npm)

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (7e283fd2d07e81705e23d5756d15edd4ff4dc7a074d375111155ef9dca1fd9b8) The package's declared main index.js is a trivial no-op Express middleware whose only real effect is to require('./lib/config'), a ~4 MB obfuscator.io-style bundle (rotating string array, hex-escaped entries, self-executing IIFE) that runs at import time. Package identity does not match the shipped code: package.json name is 'solidity-lock' with a vulnerability-management description, keywords advertise a logger ('fast','logger','stream','json'), scripts are 'smoke:pino'/'smoke:file', the README is a copy of pino's README with the name changed, and index.d.ts references pinojs/pino — three inconsistent cover stories layered over the opaque payload. axios ^1.10.0 is declared as a dependency but is not referenced anywhere in the plain-text sources; the only plausible consumer is the obfuscated blob, consistent with outbound HTTP from the hidden payload. Any process that requires this package executes the obfuscated bundle in-process with full host privileges.

Source published

30 Sep 2026 00:45:21 UTC

Source modified

30 Sep 2026 01:00:06 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.