MAL-2026-11071

Dashboard / Malicious Package / MAL-2026-11071

MAL-2026-11071

Summary: Malicious code in whs4_eud (npm)

Details: Source: amazon-inspector (6be47b29c887fd54b5cffc8789278f3ea7987b12d618e89c540e5670edea12b5) [email protected] declares a postinstall lifecycle script (`node index.js`) that fires unconditionally on `npm install`. On execution, index.js POSTs installer-side host information — the absolute path of the install location (which embeds the user's home directory), Node.js version, and platform/architecture — to a hardcoded Discord webhook under discord.com/api/webhooks/1530599209269465319/. The webhook URL is assembled by concatenating two string literals at runtime rather than appearing as a single literal, a light obfuscation of the exfiltration destination. The package name and layout are consistent with a dependency-confusion / typosquat beacon whose only functional behavior is to notify the author when an install occurs and to disclose where. Source: ossf-package-analysis (d906ecaf9f2ede0a31c6966b9d8402f4c80e57fb72eae7f9dfa1b3a7c583b8d4) The OpenSSF Package Analysis project identified 'whs4_eud' @ 1.0.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

References: https://www.npmjs.com/package/whs4_eud/v/1.0.1, https://www.npmjs.com/package/whs4_eud/v/1.0.0