debug-proxy-chrome-devtools

{"modified":"2026-08-13T17:26:39Z","published":"2026-08-13T17:16:22Z","schema_version":"1.7.4","id":"MAL-2026-13948","summary":"Malicious code in debug-proxy-chrome-devtools (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b7a0986932a47f49b162ea0438acfd0b6293e027e8ac2da46eb1221c5d52646c)\ndebug-proxy-chrome-devtools@1.0.1 declares a postinstall hook (`\"postinstall\": \"node install.js\"`) that automatically executes on `npm install`. install.js uses `child_process.execSync` to run `whoami` on the installer's machine and then issues an `https.get` to a hardcoded webhook.site collector (`https://webhook.site/cfe35ac2-bec3-48b8-bae1-a49dea5412c2`), passing the captured command output and hostname/command identifiers as URL query parameters. The package advertises itself as a Chrome DevTools debug proxy; that stated purpose has no need for shell reconnaissance or beaconing to a third-party request-inspection service. The combination of automatic install-time execution, capture of installer-side identity data, and a hardcoded non-first-party exfiltration endpoint matches the reconnaissance/beacon shape of a malicious postinstall payload.\n","affected":[{"package":{"ecosystem":"npm","name":"debug-proxy-chrome-devtools"},"versions":["1.0.2","1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"install.js","sha256":"4e51f1478473f933d6485798772b454d6903c09f446222ebdf685505199315e7","tlsh":"d33175a9c6f57a2062a1b1b0b2a78409fda38353b11e3c9cf2cd4b285b4fd6460313d9"}],"package_integrity":[{"filename":"debug-proxy-chrome-devtools-1.0.2.tgz","hashes":{"sha1":"209014de5abedc5f5c9437103451b82859549c91","sha512_sri":"sha512-4rWK2o8tqPOfpXKIYJwPiseczmWDASUoLQnyFzSVIy1ipFnOSUUQN22BR+GI5Tq1YSi3lKbWtaUMaGsc64hMcA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/debug-proxy-chrome-devtools/v/1.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/debug-proxy-chrome-devtools/v/1.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017639","import_time":"2026-08-13T17:24:45.474239794Z","modified_time":"2026-08-13T17:16:22Z","sha256":"00be2900d37e73a700651b4dfb9f6d61d41e8b5a7a6d44d073b77f1184ba415f","source":"amazon-inspector","versions":["1.0.2"]},{"id":"IN-MAL-2026-017654","import_time":"2026-08-13T17:24:46.110526876Z","modified_time":"2026-08-13T17:21:15Z","sha256":"b7a0986932a47f49b162ea0438acfd0b6293e027e8ac2da46eb1221c5d52646c","source":"amazon-inspector","versions":["1.0.1"]}]}}