whs4_deu

{"schema_version":"1.7.4","id":"MAL-2026-11070","published":"2026-07-25T16:15:37Z","modified":"2026-08-11T17:53:48.835497824Z","summary":"Malicious code in whs4_deu (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2d5a7dc2cf8fe83229aec6f45e6008ce2b353039a87607b930eb44928f97538c)\npackage.json declares a postinstall hook that runs index.js on npm install. On execution, index.js POSTs the installer's absolute __filename path (which typically embeds the OS username and directory layout), Node.js version, and platform/architecture to a hardcoded Discord webhook at discord.com/api/webhooks/1530599209269465319/. The destination is not caller-configurable, the behavior is undocumented, and the webhook URL literal is split via string concatenation to evade trivial grep for the full endpoint. The package ships no other functionality consistent with its name; the install-time beacon is the sole observable behavior.\n\n## Source: ossf-package-analysis (96d7709dc56eae4bfe07031da42425b4a94a169255cd7b3bde0f31f0516e0fb0)\nThe OpenSSF Package Analysis project identified 'whs4_deu' @ 1.0.1 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","affected":[{"package":{"name":"whs4_deu","ecosystem":"npm"},"versions":["1.0.1","1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"3027b7cb1b01364006bd3b88e0a1bed9822e2cff64dbbf83e5e0dbf0b4b07dd4","tlsh":"0061518a96f022210bb3f3d4204bc12bbb2985132a0ecd45f64c47b41fce67dd4e52e8"}],"package_integrity":[{"filename":"whs4_deu-1.0.1.tgz","hashes":{"sha1":"b37e6a0cbef42e7b4ac1e3bbbf47acd3f2161f17","sha512_sri":"sha512-s1LLJrHj4H53FsnBatcpEzck+5ANO9P/E+wlrD+XRXzbE9phPLAX24dXX4xEPmjlj0yJXZYoz4Rnsjr1kRnqQQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/whs4_deu/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/whs4_deu/v/1.0.0"}],"database_specific":{"malicious-packages-origins":[{"import_time":"2026-07-27T01:42:43.828991489Z","modified_time":"2026-07-25T16:15:37Z","sha256":"96d7709dc56eae4bfe07031da42425b4a94a169255cd7b3bde0f31f0516e0fb0","source":"ossf-package-analysis","versions":["1.0.1"]},{"id":"IN-MAL-2026-011219","import_time":"2026-08-04T22:30:05.712640939Z","modified_time":"2026-08-04T21:49:34Z","sha256":"5cb5c50b57f755039aeebab19cba308fd86dad10eddad29a94ab09396fdfe6f5","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-017377","import_time":"2026-08-11T17:51:59.301984006Z","modified_time":"2026-08-11T17:24:27Z","sha256":"2d5a7dc2cf8fe83229aec6f45e6008ce2b353039a87607b930eb44928f97538c","source":"amazon-inspector","versions":["1.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}