MAL-2026-14353

    Dashboard / Malicious Package / MAL-2026-14353

    MAL-2026-14353

    Published: 21 Aug 2026Last Modified: 21 Aug 2026

    Summary: Malicious code in @gfe/lx-watcher (npm)

    Details: Source: amazon-inspector (22abe9bf1ccb266833585bda205a07bc5c9a728763a733aa48b08fe50b640b4e) All three npm lifecycle hooks (preinstall, install, postinstall) invoke install.js, which POSTs the installer's hostname, OS username, current working directory, timestamp, and hook name to a hardcoded webhook.site collector at https://webhook.site/df384ffa-1094-4bbf-a202-e8b345b3ed18/gfe. The exfiltration fires automatically on `npm install` with no caller consent and no configuration. The package's `main` is a no-op `createWatcher` stub, so a build that resolves this scoped name silently succeeds while host identifiers are leaked. The scoped `@gfe/*` name combined with the no-op stub and the install-time beacon is the canonical dependency-confusion shape: any organization whose private `@gfe/lx-watcher` resolves against the public registry leaks host, username, and install-path metadata to the author-controlled collector.

    References: https://www.npmjs.com/package/@gfe/lx-watcher/v/1.5.3, https://www.npmjs.com/package/@gfe/lx-watcher/v/1.5.4

    Affected packages

    Package

    Name: @gfe/lx-watcher

    Purl: pkg:npm/%40gfe/lx-watcher

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.5.3
    1.5.4