@wbnr/design

{"schema_version":"1.7.4","id":"MAL-2026-11196","published":"2026-07-30T13:45:50Z","modified":"2026-08-06T23:29:17.707100905Z","summary":"Malicious code in @wbnr/design (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1dcfb8ede925ca9e0cf7574c2ba3f81ced56682ef6c54439cc00ad5fc5b960fd)\nThe package's preinstall lifecycle script runs automatically on `npm install`. It reads the installer's username (from USER/USERNAME environment variables) and the machine hostname (via os.hostname()), then embeds those identifiers along with the package name and a timestamp into both a DNS lookup and an HTTPS GET request directed at a hardcoded Burp Collaborator subdomain, 4otph6fase1x2won0hrfzul2wt2qqge5.oastify.com. The package name and scope (@wbnr) and its self-description indicate a dependency-confusion payload targeting an internal organization scope; any environment that resolves @wbnr/design from public npm will leak installer host identifiers to the attacker-controlled out-of-band endpoint. The 'harmless bug bounty PoC' framing in the package description does not change the observable behavior: installer-owned identifiers leave the machine to a third-party OOB collector on install.\n\n## Source: ossf-package-analysis (dbd908eecacbb587e9534c244be33296e6fa11092200cba8428351bb66afe844)\nThe OpenSSF Package Analysis project identified '@wbnr/design' @ 99.3.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","affected":[{"package":{"name":"@wbnr/design","ecosystem":"npm"},"versions":["99.3.0","99.0.0","99.1.0","99.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"preinstall.js","sha256":"5ca85b25f366c6f2a2fe17799593c39150e2d5e581c9827e37f033646e9f8b24","tlsh":"acf0ace8b395eb310ce012c4b16c191f95a7e35271de68824855a3d247b2a718711aa8"},{"path":"package.json","sha256":"617f3bb9665f5f662855057885a56a79c2cf590f4ddfed6c662242f8d81ec53d","tlsh":"a5e0f178cc00a83328d156d724364251e8958d6784097d0c33d3010d834f6735bff20f"}],"package_integrity":[{"filename":"design-99.3.0.tgz","hashes":{"sha1":"bb8fc9200d4177958cc09626faf51de64251aae7","sha512_sri":"sha512-2yZeeCMPEK2mEa0OetglJnF4lDOvQHRXIvV30HrJxrXxi6D1gF11PEeHiS9b2zmwmD5xLfV3zrsEso7oeIcNDQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@wbnr/design/v/99.3.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@wbnr/design/v/99.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@wbnr/design/v/99.1.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@wbnr/design/v/99.0.1"}],"database_specific":{"malicious-packages-origins":[{"import_time":"2026-07-30T14:19:34.316178276Z","modified_time":"2026-07-30T13:45:50Z","sha256":"dbd908eecacbb587e9534c244be33296e6fa11092200cba8428351bb66afe844","source":"ossf-package-analysis","versions":["99.3.0"]},{"id":"IN-MAL-2026-011131","import_time":"2026-08-04T22:30:00.784588988Z","modified_time":"2026-08-04T21:36:58Z","sha256":"1dcfb8ede925ca9e0cf7574c2ba3f81ced56682ef6c54439cc00ad5fc5b960fd","source":"amazon-inspector","versions":["99.3.0"]},{"id":"IN-MAL-2026-016682","import_time":"2026-08-06T18:09:05.600020592Z","modified_time":"2026-08-06T16:22:30Z","sha256":"0d07baf819b813827e862b75445e87817d518ede3d6c8b50e31318f7cbf1c8bb","source":"amazon-inspector","versions":["99.0.0"]},{"id":"IN-MAL-2026-016673","import_time":"2026-08-06T18:09:04.235829925Z","modified_time":"2026-08-06T16:18:59Z","sha256":"767eeda3c5b3b685e6ea9e5695dff1ab71916777db0f00e6aa07c23066dfb45b","source":"amazon-inspector","versions":["99.1.0"]},{"id":"IN-MAL-2026-016676","import_time":"2026-08-06T18:09:04.641898972Z","modified_time":"2026-08-06T16:19:58Z","sha256":"d4cb3f7aa3de4f3fd484b778d61d19ef4d8d9ff1676c356930754ed9353db9de","source":"amazon-inspector","versions":["99.0.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}