MAL-2026-10201

    Dashboard / Malicious Package / MAL-2026-10201

    MAL-2026-10201

    Published: 12 Jul 2026Last Modified: 12 Jul 2026

    Summary: Malicious code in bugexploit (npm)

    Details: Source: amazon-inspector (745f81b0c53fa121939d4f71680783860795a394eb30308f6e7e2dcf29401c92) package.json declares a `postinstall` script that runs `node index.js`. On `npm install`, index.js collects the installer's username (os.userInfo()), hostname (os.hostname()), and current working directory (process.cwd()), then POSTs them as JSON via https.request to the hardcoded endpoint https://webhook.site/cd23dfb8-a0fc-4ff7-818c-f7812fcb4bec. The transmission is unconditional and fires automatically on default install. The destination is a generic webhook-capture service unrelated to any declared package purpose, and the collected fields are host identifiers useful for victim triage / beacon confirmation.

    References: https://www.npmjs.com/package/bugexploit/v/99.9.9

    Affected packages

    Package

    Name: bugexploit

    Purl: pkg:npm/bugexploit

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    99.9.9