MAL-2026-5541

    Dashboard / Malicious Package / MAL-2026-5541

    MAL-2026-5541

    Published: 11 Jun 2026Last Modified: 11 Jun 2026

    Summary: Malicious code in @w2d/web-components (npm)

    Details: Source: amazon-inspector (2b8292b80f3e692b249561a14d94d2dfa0196f2377e7eee027b8dd630d251bd1) The package targets the @w2d scope with an artificially high version (2.999.999) — the canonical dependency-confusion shape designed to outrank an internal registry's real package. On `npm install`, postinstall.js collects host identity (os.hostname(), os.userInfo(), process.cwd(), process.platform), base64-encodes the payload, and exfiltrates it to a hardcoded Burp Collaborator OAST domain `929u6o01dc28rl4mend089t9b0hr5ht6.oastify.com` over both HTTPS GET (postinstall.js:28) and DNS lookup (postinstall.js:31). Comments in the file self-describe the package as a dependency-confusion PoC against Allwyn AG / win2day. Regardless of the author's stated bug-bounty framing, any installer whose registry configuration resolves the public @w2d/web-components instead of the intended internal package will silently beacon host/user/cwd identifiers to the attacker-controlled OAST host on install.

    References: https://www.npmjs.com/package/@w2d/web-components/v/2.999.999

    Affected packages

    Package

    Name: @w2d/web-components

    Purl: pkg:npm/%40w2d%2Fweb-components

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.999.999
    MAL-2026-5541 | CVE-DB