@offa-uwk/offa-uwk

{"schema_version":"1.7.4","id":"MAL-2026-12327","published":"2026-08-05T12:45:09Z","modified":"2026-09-01T11:20:23.908411827Z","summary":"Malicious code in @offa-uwk/offa-uwk (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (115f62b574a9c9c91a35c6a489b74a38d6132b4d8e706deb388d2f6df1dc32f2)\nOn `npm install`, the package's postinstall script (`node index.js`) collects host identifiers (`os.hostname()`, `os.userInfo().username`, `process.cwd()`) and POSTs them via HTTPS to a hardcoded webhook.site collector at `https://webhook.site/e6b10849-38dc-4280-a8e3-72ab39cfaf65`. Immediately after the beacon, the script executes `shutdown -h now` with a fallback of `systemctl poweroff`, forcibly powering off the installing host. A preinstall step also writes a marker file to the absolute path `/home/OFFA/flag`, outside the package directory. Package metadata (name `@offa-uwk/offa-uwk`, version `999.0.6`) is consistent with a proof-of-concept malicious artifact.\n","affected":[{"package":{"name":"@offa-uwk/offa-uwk","ecosystem":"npm"},"versions":["999.0.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"0704d1cefad87e554993e01a20236708da1b46075e24907448d13c8ecb12f277","tlsh":"d83114e005b25270a7b320d5e50b781eb1b3c4077245ed20b9dc8358bfc94b8dab6af5"},{"path":"package.json","sha256":"fefbf451abc700e90ebd5b41d444085af6557a63523d1ce01b0c2f9ab5911946","tlsh":"08d0c2304e10992369c057aa0837a4467aa14e1780547c04a7eb122841dbbbb44ffb3e"}],"package_integrity":[{"filename":"offa-uwk-999.0.6.tgz","hashes":{"sha1":"187ed337d2037af38adc0e691c14f963cbb7aca0","sha512_sri":"sha512-kRYYQhn2hWYjPYxtXi1220Hm2/mrDLwjB5pAsPsfisbR1mN5H4d8ji+++eF2OQld3sED2FGnsYuXjnPrJGAGPw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@offa-uwk/offa-uwk/v/999.0.6"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014746","import_time":"2026-08-05T13:08:42.982888256Z","modified_time":"2026-08-05T12:45:09Z","sha256":"115f62b574a9c9c91a35c6a489b74a38d6132b4d8e706deb388d2f6df1dc32f2","source":"amazon-inspector","versions":["999.0.6"]},{"id":"RLMA-2026-05890","import_time":"2026-09-01T11:17:25.189861842Z","modified_time":"2026-08-24T16:26:43Z","sha256":"80f4ecaced4f0a091439f8cc561ee23f12905945c6b6fc91c11e316000263ea3","source":"reversing-labs","versions":["999.0.6"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}