zyncmap@0.0.0
Malicious code in zyncmap (npm)
T1195.002 · Compromise Software Supply ChainT1059.007 · JavaScriptT1071.001 · Web ProtocolsT1105 · Ingress Tool Transfer
Analysis
zyncmap@0.0.0 is a trojanized SVG sanitizer package. The package presents a legitimate-looking SVG processing API (sanitize, minify, save, convert to PNG) but also exports a getPlugin() function that fetches a JSON payload from hxxps://www[.]jsonkeeper[.]com/b/3P9BF (with a custom HTTP header bearrtoken:logo) and evaluates the value of the 'model' field via eval(), enabling arbitrary remote code execution. The remote host is a third-party file-hosting service, not a legitimate installer destination.
- analyzed by
- Leitwacht
- first seen
- Jun 29, 2026, 09:48 AM
- analyzed
- Jun 29, 2026, 09:48 AM
Related advisories
- ts-lint-builders-v2.1@2.1.0
- @withoneltd/lucky@0.1.4
- lessload@1.0.1
- express-mocha-test@0.0.1
- date-uuid@1.0.1
- pkg-fallback@1.1.0
- @pisell/pisellos@2.2.172
- mailconfirmer@3.3.11
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.