MAL-2026-13948

    Dashboard / Malicious Package / MAL-2026-13948

    MAL-2026-13948

    Published: 13 Aug 2026Last Modified: 13 Aug 2026

    Summary: Malicious code in debug-proxy-chrome-devtools (npm)

    Details: Source: amazon-inspector (b7a0986932a47f49b162ea0438acfd0b6293e027e8ac2da46eb1221c5d52646c) [email protected] declares a postinstall hook (`"postinstall": "node install.js"`) that automatically executes on `npm install`. install.js uses `child_process.execSync` to run `whoami` on the installer's machine and then issues an `https.get` to a hardcoded webhook.site collector (`https://webhook.site/cfe35ac2-bec3-48b8-bae1-a49dea5412c2`), passing the captured command output and hostname/command identifiers as URL query parameters. The package advertises itself as a Chrome DevTools debug proxy; that stated purpose has no need for shell reconnaissance or beaconing to a third-party request-inspection service. The combination of automatic install-time execution, capture of installer-side identity data, and a hardcoded non-first-party exfiltration endpoint matches the reconnaissance/beacon shape of a malicious postinstall payload.

    References: https://www.npmjs.com/package/debug-proxy-chrome-devtools/v/1.0.2, https://www.npmjs.com/package/debug-proxy-chrome-devtools/v/1.0.1

    Affected packages

    Package

    Name: debug-proxy-chrome-devtools

    Purl: pkg:npm/debug-proxy-chrome-devtools

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.2
    1.0.1
    MAL-2026-13948 | CVE-DB