MAL-2026-12815

    Dashboard / Malicious Package / MAL-2026-12815

    MAL-2026-12815

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in widget-forge (npm)

    Details: Source: amazon-inspector (5dc77fe941595018023e8382eac28ffdf8d1b000217a0e4d01e56e7bb48ac2d8) [email protected] is a dependency-confusion beacon. package.json declares scripts.preinstall = 'node callback.js', which auto-runs on npm install. callback.js collects os.hostname(), os.userInfo().username, process.cwd(), npm_config_registry, and CI repository identifiers (GITHUB_REPOSITORY and related CI env vars) and sends them via HTTP GET to the hardcoded bare-IP endpoint http://75.119.137.232:31337/depconfuse?pkg=.... The package has no functional payload: main is an empty object export, the description is a generic placeholder, and the version 9999.0.0 is the pattern used to outbid internal package versions in dependency-confusion attacks. The only effect of installation is the recon callback to the hardcoded IP.

    References: https://www.npmjs.com/package/widget-forge/v/9999.0.0

    Affected packages

    Package

    Name: widget-forge

    Purl: pkg:npm/widget-forge

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    9999.0.0
    MAL-2026-12815 | CVE-DB