w-screenctl

{"modified":"2026-08-07T16:53:14Z","published":"2026-08-07T16:37:30Z","schema_version":"1.7.4","id":"MAL-2026-13618","summary":"Malicious code in w-screenctl (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3b2f241eacc2eaaaac28d2b9d76aeb67042a109869b28e45a88648bf937f856f)\nWhen WScreenctl() is invoked (via the bundled g.mjs entry or the documented systemd/Task Scheduler service units), the package starts a Hapi HTTP server bound to 0.0.0.0:7000 with CORS enabled and no authentication. POST /chrome/evaluate passes the request body's `script` field directly to Playwright's page.evaluate, allowing arbitrary JavaScript execution inside the controlled Chrome instance. POST /keyboard/type, /keyboard/key, and /mouse/* forward HTTP-supplied text, key names, and coordinates into xdotool or w-mousekey/AHK, driving system-wide keyboard and mouse input on the host desktop. Because the listener binds to all interfaces with no credential check, any party reachable on the network — LAN, adjacent VLAN, or an internet-routable interface — can execute JavaScript in the browser session and drive arbitrary keystrokes and clicks on the operator's machine, which can be used to open a terminal, type shell commands, and achieve full host RCE. The dist bundle also contains child_process usage tied to ping and POST primitives consistent with this HTTP dispatch surface.\n","affected":[{"package":{"ecosystem":"npm","name":"w-screenctl"},"versions":["1.0.6","1.0.4","1.0.7"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/WScreenctl.mjs","sha256":"be376dc149a45986ed15a292fd0cd9327171c80707f0bd85e6d57aab6264d1ac","tlsh":"6c5260ba507a141a3f53fbae546f90082664b4033c196a92be5c73202fcd92d61f9ff5"}],"package_integrity":[{"filename":"w-screenctl-1.0.6.tgz","hashes":{"sha1":"e6ce9dc206126a777ef8ec434932d28aad26eb88","sha512_sri":"sha512-tWtg49r340m9ZSCP1e0+PA4g/6OehjSdthVF8XMzJb8Yd4yu3O3HCH47Nxeo+rHPcc3Z7q1RCwXdiQufYlcYIg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/w-screenctl/v/1.0.6"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/w-screenctl/v/1.0.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/w-screenctl/v/1.0.7"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017112","import_time":"2026-08-07T16:51:14.781923366Z","modified_time":"2026-08-07T16:37:30Z","sha256":"3b2f241eacc2eaaaac28d2b9d76aeb67042a109869b28e45a88648bf937f856f","source":"amazon-inspector","versions":["1.0.6"]},{"id":"IN-MAL-2026-017114","import_time":"2026-08-07T16:51:14.986569827Z","modified_time":"2026-08-07T16:37:47Z","sha256":"cfbb40fea41b3fe5dded40f87d00777d79eda90d034f1e636db7eff4c66d4f70","source":"amazon-inspector","versions":["1.0.4"]},{"id":"IN-MAL-2026-017113","import_time":"2026-08-07T16:51:14.891590759Z","modified_time":"2026-08-07T16:37:37Z","sha256":"fb31a66477cc291553e3123de783c519b6eedba6b6168f6b4d3e90a5a293a437","source":"amazon-inspector","versions":["1.0.7"]}]}}