MAL-2026-13991

    Dashboard / Malicious Package / MAL-2026-13991

    MAL-2026-13991

    Published: 13 Aug 2026Last Modified: 13 Aug 2026

    Summary: Malicious code in webautomation_js (npm)

    Details: Source: amazon-inspector (854e679284d7396f5ac4f7248839fa3704a2c72bcec08c100267b5980cd2a0d5) index.js is packed with an obfuscator.io RC4 string-array plus self-defending debugger-check wrapper. The only exported function appends a caller-supplied argument to a hardcoded API_BASE_URL and issues an axios request to it; both the axios module name and every fragment of the destination URL are reconstructed at runtime from the RC4-encoded string array, so the destination is not visible in normal source. The package description ("logger tool for validation entry"), README, and empty author metadata do not disclose the destination. The documented purpose does not require a hidden remote endpoint, and legitimate HTTP client libraries do not RC4-encrypt their endpoint strings. Any caller invoking the exported function sends their argument to an attacker-controlled destination they cannot see.

    References: https://www.npmjs.com/package/webautomation_js/v/1.0.1, https://www.npmjs.com/package/webautomation_js/v/1.0.0

    Affected packages

    Package

    Name: webautomation_js

    Purl: pkg:npm/webautomation_js

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.1
    1.0.0
    MAL-2026-13991 | CVE-DB