MAL-2026-16202

    Dashboard / Malicious Package / MAL-2026-16202

    MAL-2026-16202

    Published: 14 Sept 2026Last Modified: 16 Sept 2026

    Summary: Malicious code in webpackbootstrapscripts (npm)

    Details: [email protected] typosquats bootstrap and ships a disguised in-browser proxy kit. Its bundled loader (index-z2b7r4.js) XOR-decodes a list of endpoints with a fixed key and injects remote scripts from https://dyingefforlessefforlessours.com via document.head.appendChild, then boots a Scramjet/wisp WebSocket proxy that routes page traffic through operator-controlled relays. The loader matches (same sha256) sibling packages webpackbootstrapscripts and @zaka13/thing by the same publisher (zaka13). Harm is browser-side when the asset is served; no install script runs.

    References:

    Affected packages

    Package

    Name: webpackbootstrapscripts

    Purl: pkg:npm/webpackbootstrapscripts

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    5.110.3