webdev-conf

{"modified":"2026-08-04T23:57:12Z","published":"2026-08-04T23:57:12Z","schema_version":"1.7.4","id":"MAL-2026-12005","summary":"Malicious code in webdev-conf (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9577d9f40486af224c5dd365ffbab6a5d45c4a052dfe6de50bc1d8f130d9642a)\nwebdev-conf@5.0.0 is a typosquat of the sindresorhus/pkg-conf library, published under author 'Sinde Sorus' <sindesorus@gmail.com> (homoglyph of Sindre Sorhus). index.js appends an eval(atob(...)) block after the legitimate library code. On require(), the decoded payload queries public Ethereum RPC endpoints and blockscout.com/api for the latest transaction sent from the attacker address 0xa322E5f3D311D3080e6f01210263e9aDC2490Ef1, extracts an IP address from that transaction, then fetches XOR-encrypted next-stage JavaScript from http://<IP>:443/0x/cls and http://<IP>:443/0x/ls, eval()s it in-process, and re-executes it via spawn('node', ['-e', payload], {detached:true, windowsHide:true}).unref(). Identifiers such as http, https, child_process, spawn, and the RPC URLs are hidden with \\uXXXX unicode escapes. The C2 IP is rotatable by the attacker via on-chain transactions (EtherHiding technique). Any package that require()s webdev-conf triggers remote code execution on the installer's host.\n","affected":[{"package":{"ecosystem":"npm","name":"webdev-conf"},"versions":["5.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"9f1e75859e696811640fc348a0e7dfe664ed5dcd95017eacd7d6cdf3b3025d46","tlsh":"ea521daa4692bb9bcb1b2673fc87570d237840b67a9c2b45310fd874b389c55748e60f"},{"path":"package.json","sha256":"a999c4f3ed5d91129e457e2c1d85d6e9bee0018306ec3698f9268fa948603d16","tlsh":"6a01f113852dded303d8aaec9c5ed4c7506f505228c69cee8cd3f634c2ec151128b156"}],"package_integrity":[{"filename":"webdev-conf-5.0.0.tgz","hashes":{"sha1":"8e679576b51036735148dea39c01b29c65773229","sha512_sri":"sha512-oAnxnTtmyuLw5yHEmj37JWq09sEl1nCkvAx5EfkSvzGkcZy1pAw8WgMslFbb4qVQwSzdwW9Sf7TIuMu93QsJmw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/webdev-conf/v/5.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-011359","import_time":"2026-08-05T00:04:38.694650379Z","modified_time":"2026-08-04T23:57:12Z","sha256":"9577d9f40486af224c5dd365ffbab6a5d45c4a052dfe6de50bc1d8f130d9642a","source":"amazon-inspector","versions":["5.0.0"]}]}}