---
id: "MAL-2026-18184"
kind: "package"
aliases: ["MAL-2026-18184"]
title: "Malicious code in formatting-subtitles (npm)"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "formatting-subtitles", "fixed": [], "affected": "= 1.0.2", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["malicious", "package"]
not_affected_if: []
published_at: "2026-10-22T06:11:06+00:00"
first_seen_at: "2026-10-26T20:51:49+00:00"
updated_at: "2026-10-26T21:05:48+00:00"
sources: [{"source": "osv-malicious", "url": "https://osv.dev/vulnerability/MAL-2026-18184", "first_seen_at": "2026-10-26T20:51:49+00:00"}]
---

# Malicious code in formatting-subtitles (npm)

## Affected

- npm:formatting-subtitles affected = 1.0.2 fixed ?

## Timeline

- 2026-10-26T20:51:49+00:00 osv-malicious https://osv.dev/vulnerability/MAL-2026-18184

## From the sources

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (25577370189f57a5678b2f2c45e212abfc79a3675dc7d51581f633e78aba47a6)
package.json declares `preinstall: sh./prepare.js && exit 0`. prepare.js is shaped like JavaScript (ending with `console.log('hello world')`) but is executed by /bin/sh, which does not treat `/**... */` as a comment. Inside that block, sh evaluates two `$(...)` command substitutions: one issues a GET to the hardcoded collector https://webhook.site/9e8c8742-3102-4716-aa8b-e150e9e84fe7/stats_1, and the other downloads https://api.github.com/gists/da04f14c93acbe9a7aef827be0a2e91c, extracts a file via jq, writes it to disk as `x`, and runs it with `sh x`. On `npm install`, the installer host fetches and executes arbitrary, unpinned, attacker-controlled content from a mutable GitHub Gist, and the webhook.site beacon discloses the install (and curl-visible metadata such as public IP and user-agent) to the attacker. The JS-comment-wrapping of the shell payload is a deliberate cover story so prepare.js reads as a trivial hello-world when viewed as JavaScript.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_