wct-st

{"modified":"2026-08-13T21:39:27Z","published":"2026-08-13T21:39:27Z","schema_version":"1.7.4","id":"MAL-2026-13990","summary":"Malicious code in wct-st (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3065a54d66ae4872334224443453c85f98c9ab8ae9d87df215bb51a5ba5e7595)\nOn `npm install`, the package's postinstall lifecycle script collects installer host identifiers (hostname, platform, architecture, Node.js version, package name, npm lifecycle event) and POSTs them as JSON to the hardcoded remote endpoint https://bhvte4h4.instances.poc.jchunt.top/wct-st. The beacon fires automatically with no consent, configuration, or opt-out. The package name resembles the deprecated `web-component-tester`, consistent with a typosquat / dependency-confusion beacon shape.\n","affected":[{"package":{"ecosystem":"npm","name":"wct-st"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"postinstall.js","sha256":"a8ec809c549c9e9e35dc4a681f4171a28477344863a71f5f7ae1caa0579c0aef","tlsh":"ed0123c1d2b55a7127b852c068f1af0793bbf223370220b579c404e92f8d0f5003119d"}],"package_integrity":[{"filename":"wct-st-1.0.0.tgz","hashes":{"sha1":"e1b5e2517bc914ea5b55e4a8294ce2a8f75064bc","sha512_sri":"sha512-/yu/DV8r41Wl/7vOQe4K4IBiOg8pbAHkj3UrZRt0GdZZ+5keMKFuFNmGpOIn9kRGk4BbLU+PeHs1ePpr/Fc22g=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/wct-st/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017710","import_time":"2026-08-13T21:50:20.233851636Z","modified_time":"2026-08-13T21:39:27Z","sha256":"3065a54d66ae4872334224443453c85f98c9ab8ae9d87df215bb51a5ba5e7595","source":"amazon-inspector","versions":["1.0.0"]}]}}