MAL-2026-18207: Malicious code in @ecg-internal/aurora-js-formatters
Summary
MAL-2026-18207: Installation or loading can expose host and build-environment details to an external endpoint, and the machine should be treated as compromised. Affects @ecg-internal/aurora-js-formatters versions 1.0.0 – 99.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
@ecg-internal/aurora-js-formatters is an npm package in the JavaScript ecosystem. It presents itself as a formatter package, but the supplied report describes code that runs during installation and when the module is loaded. Its no-op exports allow consuming code and bundlers to continue, so the behavior can occur silently in build pipelines.
Vulnerability Detail
The package contains embedded malicious code that sends host and build-environment information to an external endpoint. Its postinstall script runs beacon.cjs, which sends package, hostname, install-path, working-directory, and runtime details; importing the module also triggers the beacon, even when lifecycle scripts are disabled. The report says any computer with the package installed or running should be considered fully compromised, and removing the package alone may not remove other malicious software.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @ecg-internal/aurora-js-formattersIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Documented workaround: Remove @ecg-internal/aurora-js-formatters and rotate all secrets and keys stored on the affected computer from a different computer. Treat the host as compromised; removal alone cannot guarantee that other malicious software is gone.
Conclusion
No fixed version is published for @ecg-internal/aurora-js-formatters. Remove it and treat any computer where it was installed or run as compromised; rotate its stored secrets and keys from a different computer. Removal alone does not guarantee that other malicious software is gone. Vulert monitors the dependencies in package-lock.json and alerts when a new vulnerability affects them; check an application at https://vulert.com/scanner.
See every vulnerability recorded for @ecg-internal/aurora-js-formatters →
FAQ
@ecg-internal/aurora-js-formatters is affected across the published range introduced at 0; the report identifies versions 1.0.0, 2.0.0, 2.0.1, 3.0.0, and 99.0.1.
@ecg-internal/aurora-js-formatters sends host and build-environment details to an external endpoint; the affected computer should be treated as fully compromised.
No fixed version is published for @ecg-internal/aurora-js-formatters; remove the package and follow the documented response for affected computers.
Remove @ecg-internal/aurora-js-formatters rather than retaining it, and rotate stored secrets and keys from a different computer.
Search package-lock.json for @ecg-internal/aurora-js-formatters. Vulert can scan a manifest or SBOM and monitor the dependency at Vulert Scanner.
