Malicious Code Vulnerability in @rutxploit-sec/subsplash-canny Package
Summary
MAL-2026-17288: Malicious code in @rutxploit-sec/subsplash-canny (npm). Affects @rutxploit-sec/subsplash-canny versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @rutxploit-sec/subsplash-canny package is an npm library that is designed to serve as a proof-of-concept for dependency confusion attacks. It impersonates the private scoped package @subsplash/canny, which can mislead developers into using it as a legitimate dependency. This package includes a preinstall lifecycle script that executes malicious code during installation.
Vulnerability Detail
The vulnerability originates from a preinstall lifecycle script in the @rutxploit-sec/subsplash-canny package. This script runs inline JavaScript code that retrieves the system's hostname and the OS username, then sends this information via an HTTP GET request to a specified endpoint (127.0.0.1:8099). Although the current endpoint is loopback, the mechanism allows for arbitrary code execution and identity collection, posing a significant risk if directed to a remote server. This vulnerability can lead to unauthorized data collection and potential exploitation of the user's environment.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @rutxploit-sec/subsplash-cannyIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can avoid using the @rutxploit-sec/subsplash-canny package altogether. If you need similar functionality, consider using a verified alternative package that does not contain malicious code.
Conclusion
The @rutxploit-sec/subsplash-canny package contains a serious vulnerability due to embedded malicious code that executes during installation. It is crucial to remove this package from your project and to use trusted alternatives. Monitoring tools like Vulert can help in identifying such vulnerabilities in the future.
See every vulnerability recorded for @rutxploit-sec/subsplash-canny →
FAQ
It is an npm package that serves as a proof-of-concept for dependency confusion attacks, impersonating a legitimate package.
The malicious code is executed during the installation process due to a preinstall lifecycle script that runs inline JavaScript.
It collects the system's hostname and the OS username, sending this data to a specified endpoint.
Yes, if you have installed the @rutxploit-sec/subsplash-canny package, your application may be at risk of data collection and exploitation.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. With Vulert's playground, you can check if your application is affected by this vulnerability without needing to sign up.
