MAL-2026-11070

Dashboard / Malicious Package / MAL-2026-11070

MAL-2026-11070

Summary: Malicious code in whs4_deu (npm)

Details: Source: amazon-inspector (2d5a7dc2cf8fe83229aec6f45e6008ce2b353039a87607b930eb44928f97538c) package.json declares a postinstall hook that runs index.js on npm install. On execution, index.js POSTs the installer's absolute __filename path (which typically embeds the OS username and directory layout), Node.js version, and platform/architecture to a hardcoded Discord webhook at discord.com/api/webhooks/1530599209269465319/. The destination is not caller-configurable, the behavior is undocumented, and the webhook URL literal is split via string concatenation to evade trivial grep for the full endpoint. The package ships no other functionality consistent with its name; the install-time beacon is the sole observable behavior. Source: ossf-package-analysis (96d7709dc56eae4bfe07031da42425b4a94a169255cd7b3bde0f31f0516e0fb0) The OpenSSF Package Analysis project identified 'whs4_deu' @ 1.0.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

References: https://www.npmjs.com/package/whs4_deu/v/1.0.1, https://www.npmjs.com/package/whs4_deu/v/1.0.0