{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "index.js",
              "sha256": "aaf3d79dad11e28c542b6c821d40eb94ae567540fa0b0f220758298261a2a226",
              "tlsh": "94712bbcd0b63a85053d669299dd1acef27eac6774794b04b77e1fc647208e1007366c"
            }
          ],
          "package_integrity": [
            {
              "filename": "font-1.0.1.tgz",
              "hashes": {
                "sha1": "8cc67cdd396f5dcd2c0c42155687aeadee2ef955",
                "sha512_sri": "sha512-mKukNtzq9ABPKoKS9vJb/MlymD0QHFySGNN4GfBQqFrtEVQwKGCfAUMGn8XsSGsr9L+aEsLqC2tE5dos0BDJ/w=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "@next-fonts/font"
      },
      "versions": [
        "1.0.1",
        "1.0.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-018501",
        "import_time": "2026-08-21T04:48:53.490398489Z",
        "modified_time": "2026-08-21T04:28:59Z",
        "sha256": "1165fecff800f58383c09762935267dddab4d21d37f6166d4e3ceaf0d9175191",
        "source": "amazon-inspector",
        "versions": [
          "1.0.1"
        ]
      },
      {
        "id": "IN-MAL-2026-018502",
        "import_time": "2026-08-21T04:48:53.529322071Z",
        "modified_time": "2026-08-21T04:29:07Z",
        "sha256": "4e536e77176d5fb4637105c50280763e82a6a273dd7de35bb82da340b0f71163",
        "source": "amazon-inspector",
        "versions": [
          "1.0.0"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4e536e77176d5fb4637105c50280763e82a6a273dd7de35bb82da340b0f71163)\n@next-fonts/font is a typosquat of Next.js\u0027s @next/font. Its exported Inter() function (mimicking next/font/google) decodes a base64 blob via atob(), then executes it through spawn(\u0027node\u0027,\u0027-e\u0027, code) with an eval(code) fallback. The decoded payload uses on-chain data as a C2 channel: it queries api.trongrid.io or fullnode.mainnet.aptoslabs.com for a transaction tied to hardcoded wallet addresses, retrieves that transaction\u0027s input data from BSC RPC endpoints (bsc-dataseed.binance.org, bsc-rpc.publicnode.com) via eth_getTransactionByHash, XOR-decrypts the returned bytes, and evals the resulting JavaScript. The result is arbitrary attacker-controlled code execution on any Node process that imports the package and invokes Inter(), with no relation to font functionality. Obfuscation (base64-hidden payload, node -e detached spawn with eval fallback, blockchain-mediated fetch) conceals the downloader from casual inspection.\n",
  "id": "MAL-2026-14346",
  "modified": "2026-08-21T04:50:41Z",
  "published": "2026-08-21T04:28:59Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@next-fonts/font/v/1.0.1"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@next-fonts/font/v/1.0.0"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in @next-fonts/font (npm)"
}