MAL-2026-13618

    Dashboard / Malicious Package / MAL-2026-13618

    MAL-2026-13618

    Published: 7 Aug 2026Last Modified: 7 Aug 2026

    Summary: Malicious code in w-screenctl (npm)

    Details: Source: amazon-inspector (3b2f241eacc2eaaaac28d2b9d76aeb67042a109869b28e45a88648bf937f856f) When WScreenctl() is invoked (via the bundled g.mjs entry or the documented systemd/Task Scheduler service units), the package starts a Hapi HTTP server bound to 0.0.0.0:7000 with CORS enabled and no authentication. POST /chrome/evaluate passes the request body's `script` field directly to Playwright's page.evaluate, allowing arbitrary JavaScript execution inside the controlled Chrome instance. POST /keyboard/type, /keyboard/key, and /mouse/* forward HTTP-supplied text, key names, and coordinates into xdotool or w-mousekey/AHK, driving system-wide keyboard and mouse input on the host desktop. Because the listener binds to all interfaces with no credential check, any party reachable on the network — LAN, adjacent VLAN, or an internet-routable interface — can execute JavaScript in the browser session and drive arbitrary keystrokes and clicks on the operator's machine, which can be used to open a terminal, type shell commands, and achieve full host RCE. The dist bundle also contains child_process usage tied to ping and POST primitives consistent with this HTTP dispatch surface.

    References: https://www.npmjs.com/package/w-screenctl/v/1.0.6, https://www.npmjs.com/package/w-screenctl/v/1.0.4, https://www.npmjs.com/package/w-screenctl/v/1.0.7

    Affected packages

    Package

    Name: w-screenctl

    Purl: pkg:npm/w-screenctl

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.6
    1.0.4
    1.0.7
    MAL-2026-13618 | CVE-DB