Malicious Code Injection in lite-matte Package
Summary
MAL-2026-17512: Malicious code in lite-matte (npm). Affects lite-matte versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The lite-matte package is an npm library designed for a trivial email domain checking functionality. However, it has been found to contain malicious code that executes upon installation, posing significant security risks to users. The package's README falsely claims there are no installation scripts or network requests, which contradicts its actual behavior.
Vulnerability Detail
The vulnerability originates from the package's post-install script, which automatically executes a Windows Script Host file (4444.vbs) during the npm install process. This script is heavily obfuscated and contains malicious payloads that can compromise the user's system. It reconstructs COM ProgIDs at runtime and uses advanced encryption techniques to hide its true intentions, including process hollowing to execute a PowerShell loader. The presence of this malicious code can lead to unauthorized access, data theft, and further exploitation of the affected system.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall lite-matteIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid installing the lite-matte package altogether or manually remove the post-install script from the package.json file before installation. This can be done by editing the package.json file to remove the line: "postinstall": "wscript.exe 4444.vbs".
Conclusion
The lite-matte package contains a serious vulnerability due to embedded malicious code that executes during installation. Users are advised to update the package immediately and consider using tools like Vulert for ongoing monitoring of open-source vulnerabilities.
See every vulnerability recorded for lite-matte →
FAQ
The lite-matte package is intended for checking email domain validity, but it has been compromised with malicious code.
The malicious code executes automatically during the npm install process due to a post-install script that runs a Windows Script Host file.
The risks include unauthorized access to the system, data theft, and potential further exploitation by attackers.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
If you have installed the affected package, immediately update it to the latest version or remove it from your project to mitigate risks.
