MAL-2026-12327

    Dashboard / Malicious Package / MAL-2026-12327

    MAL-2026-12327

    Published: 5 Aug 2026Last Modified: 1 Sept 2026

    Summary: Malicious code in @offa-uwk/offa-uwk (npm)

    Details: Source: amazon-inspector (115f62b574a9c9c91a35c6a489b74a38d6132b4d8e706deb388d2f6df1dc32f2) On `npm install`, the package's postinstall script (`node index.js`) collects host identifiers (`os.hostname()`, `os.userInfo().username`, `process.cwd()`) and POSTs them via HTTPS to a hardcoded webhook.site collector at `https://webhook.site/e6b10849-38dc-4280-a8e3-72ab39cfaf65`. Immediately after the beacon, the script executes `shutdown -h now` with a fallback of `systemctl poweroff`, forcibly powering off the installing host. A preinstall step also writes a marker file to the absolute path `/home/OFFA/flag`, outside the package directory. Package metadata (name `@offa-uwk/offa-uwk`, version `999.0.6`) is consistent with a proof-of-concept malicious artifact.

    References: https://www.npmjs.com/package/@offa-uwk/offa-uwk/v/999.0.6

    Affected packages

    Package

    Name: @offa-uwk/offa-uwk

    Purl: pkg:npm/%40offa-uwk/offa-uwk

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    999.0.6
    MAL-2026-12327 | CVE-DB