MAL-2026-10080

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/webrix-docs/MAL-2026-10080.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10080
Published
2026-07-09T15:45:45Z
Modified
2026-07-09T16:32:05.078737603Z
Summary
Malicious code in webrix-docs (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (bec06de7c68db5cdd90e4b05be057a583f1a2318174916af07ed86d52a5011fc)

package.json declares preinstall: node index.js, which runs automatically on npm install. index.js collects host reconnaissance data — os.hostname(), os.userInfo() (username, uid, gid, homedir), process.platform, cwd, and the output of whoami/id spawned via child_process — and POSTs it as JSON to the hardcoded URL https://c7kfuaf25guwigaz6r03kxet0k6bu3is.oastify.com/detox56 (a Burp Collaborator / oastify.com out-of-band interaction subdomain). The package has an empty description and author, no library code, and a name that mimics the legitimate webrix UI library — consistent with a typosquat/dependency-confusion lure whose only purpose is the install-time beacon.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-07-09T16:20:52.20436572Z",
            "source": "amazon-inspector",
            "sha256": "bec06de7c68db5cdd90e4b05be057a583f1a2318174916af07ed86d52a5011fc",
            "versions": [
                "20.2.11"
            ],
            "id": "IN-MAL-2026-009220",
            "modified_time": "2026-07-09T15:45:45Z"
        }
    ]
}
References
Credits

Affected packages

npm / webrix-docs

Package

Name
webrix-docs
View open source insights on deps.dev
Purl
pkg:npm/webrix-docs

Affected ranges

Affected versions

20.*
20.2.11

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "bf5140c515f65a251ba7b8494a4f9012a327e0033509ee55bfcc8340af9937c97f0bf6",
            "sha256": "47f1b70eb518ccb31df256490ddd800165fe3f0d1657e4e6c0e7e7ec22e9adb2",
            "path": "index.js"
        },
        {
            "tlsh": "a8d0a7344d21953365c106660c2ba48773619f2f04047c0863df1c2c42de677a8ff30d",
            "sha256": "13c39b42b41a522b740c4dd07d087a740580d209cd625eb5e4df816f3a70cc4e",
            "path": "package.json"
        }
    ],
    "package_integrity": [
        {
            "filename": "webrix-docs-20.2.11.tgz",
            "hashes": {
                "sha1": "609b5c3ba7e9bd46c165e77c015e5819a51c2c1c",
                "sha512_sri": "sha512-rZx3z0xauZf2TJPjkHmvurgRhEzdgtJYN3kpEAU+jKAo9M8k1U9fk58EYWPII4WKIXFZf5C3aIrP8mx00tDJOw=="
            }
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/webrix-docs/MAL-2026-10080.json"