MAL-2026-12326

    Dashboard / Malicious Package / MAL-2026-12326

    MAL-2026-12326

    Published: 5 Aug 2026Last Modified: 1 Sept 2026

    Summary: Malicious code in @offa/offa-uwk (npm)

    Details: Source: amazon-inspector (3a04489d4763fb48f4c5bc4ea7e99802b21a412ba55900ae7bf411070e2a42d8) package.json declares a postinstall hook that runs index.js. On install, index.js collects os.hostname(), os.userInfo().username, process.cwd(), and the entire process.env object, then POSTs the JSON payload via https.request to the hardcoded endpoint https://e6b10849-38dc-4280-a8e3-72ab39cfaf65.webhook.site/collect. Dumping the whole process environment on install ships every environment variable on the installer's machine — commonly containing AWS/GCP/GitHub/npm and other tokens — to an anonymous attacker-controlled webhook. A preinstall hook additionally writes a marker file to the hardcoded absolute path /home/OFFA/flag.

    References: https://www.npmjs.com/package/@offa/offa-uwk/v/999.0.1, https://www.npmjs.com/package/@offa/offa-uwk/v/999.0.0

    Affected packages

    Package

    Name: @offa/offa-uwk

    Purl: pkg:npm/%40offa/offa-uwk

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    999.0.1
    999.0.0