webautomation_js

{"modified":"2026-08-13T21:52:19Z","published":"2026-08-13T21:38:46Z","schema_version":"1.7.4","id":"MAL-2026-13991","summary":"Malicious code in webautomation_js (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (854e679284d7396f5ac4f7248839fa3704a2c72bcec08c100267b5980cd2a0d5)\nindex.js is packed with an obfuscator.io RC4 string-array plus self-defending debugger-check wrapper. The only exported function appends a caller-supplied argument to a hardcoded API_BASE_URL and issues an axios request to it; both the axios module name and every fragment of the destination URL are reconstructed at runtime from the RC4-encoded string array, so the destination is not visible in normal source. The package description (\"logger tool for validation entry\"), README, and empty author metadata do not disclose the destination. The documented purpose does not require a hidden remote endpoint, and legitimate HTTP client libraries do not RC4-encrypt their endpoint strings. Any caller invoking the exported function sends their argument to an attacker-controlled destination they cannot see.\n","affected":[{"package":{"ecosystem":"npm","name":"webautomation_js"},"versions":["1.0.1","1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"b1effec9823fe570bc231d1fa2a6b60bcfff6afdc137e787206cc5382cf10f9b","tlsh":"35d0957774c1111a877127a041ef2905330761fc7e0023d47254d5373519dd56842ffd"}],"package_integrity":[{"filename":"webautomation_js-1.0.1.tgz","hashes":{"sha1":"8cc2fe3b2fbf7aaf1ea624464ada426b94cc50d3","sha512_sri":"sha512-wcgFmojGQkybzfvL/YyhEJHP99nUFIV8Td321HFXnvAVMCtXm4wxh8/WiU16MxpN7WHqzGhRTL5OqVAD+lCTVA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/webautomation_js/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/webautomation_js/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017709","import_time":"2026-08-13T21:50:20.167477568Z","modified_time":"2026-08-13T21:38:56Z","sha256":"4e620ac0a2aea29f0b5ee3e7dd04a7eccfb30e1126dd0e41da64d989fb8ac4fe","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-017708","import_time":"2026-08-13T21:50:20.095255767Z","modified_time":"2026-08-13T21:38:46Z","sha256":"854e679284d7396f5ac4f7248839fa3704a2c72bcec08c100267b5980cd2a0d5","source":"amazon-inspector","versions":["1.0.0"]}]}}