Malware Threat from Image Processing Packages

• •Two critical vulnerabilities in 'cdn-img-fetch' allow malware installation.
• •Malware is hidden in a PNG file and decrypted upon package installation.
• •All systems using these packages are considered fully compromised.

Two vulnerabilities, MAL-2026-17216 and MAL-2026-17330, were disclosed on 2026-10-13, affecting the npm package 'cdn-img-fetch'. Both vulnerabilities allow attackers to drop malicious executables on systems that install or require this package. The malware is hidden within a PNG file, decrypted using a hardcoded key, and written to a persistent location on the filesystem. Any system running these packages is considered fully compromised, with all secrets and keys at risk. The vulnerabilities are linked to a deceptive image processing claim, with no legitimate functionality matching the malicious behavior. Users are advised to remove the affected packages immediately.