self-v8

{"modified":"2026-10-29T00:00:00Z","schema_version":"1.7.4","id":"MAL-2026-18445","summary":"Malicious code in self-v8 (npm)","details":"Malicious package. `self-v8` is an npm package that harvests sensitive data on the victim host and exfiltrates it to an attacker-controlled Discord webhook. Classification: information stealer. The package provides no legitimate functionality, so all published versions are malicious. Full indicators are published at the reference below.","affected":[{"package":{"ecosystem":"npm","name":"self-v8","purl":"pkg:npm/self-v8"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.0.0","2.1.8","2.1.9","8.1.9","8.3.9","8.5.9","8.7.9","8.9.9"]}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/self-v8"},{"type":"WEB","url":"https://wormsign.io/portfolio/self-v8/"}],"credits":[{"name":"wormsign","type":"FINDER","contact":["https://x.com/w0rmsign"]}],"database_specific":{"iocs":{"urls":["https://discord.com/api/webhooks/1450251813067423817/"]}}}