whs4_ued

{"modified":"2026-08-11T17:24:09Z","published":"2026-08-11T17:24:09Z","schema_version":"1.7.4","id":"MAL-2026-13743","summary":"Malicious code in whs4_ued (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6be723a2156cdb77cc97a0afb9ee15e4d50928a1924cd6cde69bcaacf2707a8b)\nOn npm install, the package's postinstall hook runs `node index.js`, which POSTs installer host information — the absolute path of the package file (leaking the OS username and home directory layout), Node.js version, platform, and architecture — to a hardcoded Discord webhook at discord.com/api/webhooks/1530599209269465319/. The webhook token is assembled via string concatenation at the call site to evade naive string matching. The destination is attacker-controlled and unrelated to the package's stated educational typo-catcher purpose, and there is no consent gate.\n","affected":[{"package":{"ecosystem":"npm","name":"whs4_ued"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"2ea6b8cda775d8d5fab218c99e9663f69b8d67929e420f2f75a4139cdc778670","tlsh":"3a61518a96f022214ba3f3d4604bc12bbb2985132a0ecd45f64c47b41fce67dd4e52e8"}],"package_integrity":[{"filename":"whs4_ued-1.0.0.tgz","hashes":{"sha1":"079d5390ebaa82b529fb9dc6f790551b9b6a4ad2","sha512_sri":"sha512-caJpHmJpE+t9YD+nBxcHVFKF52p7G5fH3ZMA+TKHtH+GcIWlQ2t51qO2xq17jLMsPtl0PafCo8WbYu6gzb6LjA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/whs4_ued/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017375","import_time":"2026-08-11T17:51:59.184682055Z","modified_time":"2026-08-11T17:24:09Z","sha256":"6be723a2156cdb77cc97a0afb9ee15e4d50928a1924cd6cde69bcaacf2707a8b","source":"amazon-inspector","versions":["1.0.0"]}]}}