MAL-2026-12005
Dashboard / Malicious Package / MAL-2026-12005
MAL-2026-12005
Summary: Malicious code in webdev-conf (npm)
Details: Source: amazon-inspector (9577d9f40486af224c5dd365ffbab6a5d45c4a052dfe6de50bc1d8f130d9642a) [email protected] is a typosquat of the sindresorhus/pkg-conf library, published under author 'Sinde Sorus' <[email protected]> (homoglyph of Sindre Sorhus). index.js appends an eval(atob(...)) block after the legitimate library code. On require(), the decoded payload queries public Ethereum RPC endpoints and blockscout.com/api for the latest transaction sent from the attacker address 0xa322E5f3D311D3080e6f01210263e9aDC2490Ef1, extracts an IP address from that transaction, then fetches XOR-encrypted next-stage JavaScript from http://<IP>:443/0x/cls and http://<IP>:443/0x/ls, eval()s it in-process, and re-executes it via spawn('node', ['-e', payload], {detached:true, windowsHide:true}).unref(). Identifiers such as http, https, child_process, spawn, and the RPC URLs are hidden with \uXXXX unicode escapes. The C2 IP is rotatable by the attacker via on-chain transactions (EtherHiding technique). Any package that require()s webdev-conf triggers remote code execution on the installer's host.
Affected packages
Package
Name: webdev-conf
Purl: pkg:npm/webdev-conf
Affected ranges
Type: N/A
Events:
