bender-rspack-config

{"schema_version":"1.7.4","id":"MAL-2026-16221","published":"2026-09-15T17:26:13Z","modified":"2026-09-17T14:22:18.501861018Z","summary":"Malicious code in bender-rspack-config (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3a6997cea54ae81d1addcb41ddac29e94923dfa1042265253c555cb4945ad5b4)\npackage.json declares a preinstall lifecycle script that runs `wget` against a hardcoded webhook.site URL, embedding `$(whoami)`, `$(pwd)`, and `$(hostname)` as query-string parameters. The request fires automatically on `npm install`, transmitting the installer's username, working-directory path, and hostname to an author-controlled collector at webhook.site/9d385aa8-875e-48b6-938c-6c0f5a0e8319/. The behavior is self-labeled as a dependency-confusion proof of concept, but the shipped code is a functioning identity-beacon regardless of framing.\n\n## Source: ossf-package-analysis (159730c04aeb50c0e832685be81c3f332d8692bf4a9f1a419c7223dbe5059491)\nThe OpenSSF Package Analysis project identified 'bender-rspack-config' @ 1.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n","affected":[{"package":{"name":"bender-rspack-config","ecosystem":"npm"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"ff66c2a723b54fa934e286f4aefb19db59825fb6912b4b2b50ea5dda6261c6b0","tlsh":"3401dd39f124bea31bc44ba00164422bba26ff9bc3053c0debe32a19d30d9b6007c658"}],"package_integrity":[{"filename":"bender-rspack-config-1.0.0.tgz","hashes":{"sha1":"429421e2e328596c43c0be9acfea283f17d05a64","sha512_sri":"sha512-uf/eVs4aQIyqybrkSlwfDKjeB7l8yj8tHFyl2KDpX75pq30Vk9Qaig5yGoGejOUor+h7eFgeFrOp8FOxEjUIKg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bender-rspack-config/v/1.0.0"}],"database_specific":{"malicious-packages-origins":[{"import_time":"2026-09-16T10:19:31.458108308Z","modified_time":"2026-09-15T17:26:13Z","sha256":"159730c04aeb50c0e832685be81c3f332d8692bf4a9f1a419c7223dbe5059491","source":"ossf-package-analysis","versions":["1.0.0"]},{"id":"IN-MAL-2026-020119","import_time":"2026-09-17T14:20:23.118241449Z","modified_time":"2026-09-17T14:12:50Z","sha256":"3a6997cea54ae81d1addcb41ddac29e94923dfa1042265253c555cb4945ad5b4","source":"amazon-inspector","versions":["1.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}