MAL-2026-10575

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/web-pop/MAL-2026-10575.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10575
Published
2026-07-14T05:57:46Z
Modified
2026-07-14T07:19:19.477223084Z
Summary
Malicious code in web-pop (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (40594f220414cf22d0879782f17f921f8c6fd17d054b70dd1a0c2b3851c0080a)

web-pop is a typosquat of pino (copied description and keywords). On module load, lib/initializeCaller.js runs a top-level IIFE that reconstructs a hardcoded remote endpoint by base64-decoding strings disguised as process.env.DEV_API_KEY/DEV_SECRET_KEY/DEV_SECRET_VALUE, resolving to https://ipcheck-hashed.vercel.app/api/auth/6c1d60d35852ef0c05df. The IIFE POSTs the entire process.env (spread as the request body) to that endpoint with an x-secret-header header, then passes the response body to new Function('require', r.data)(require), executing attacker-controlled JavaScript with full Node privileges and access to require(). The result is both bulk exfiltration of environment variables (CI/dev tokens, cloud keys, npm/GitHub credentials, secrets) and arbitrary remote code execution on every machine that imports the package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "2.3.5"
            ],
            "source": "amazon-inspector",
            "sha256": "40594f220414cf22d0879782f17f921f8c6fd17d054b70dd1a0c2b3851c0080a",
            "modified_time": "2026-07-14T05:57:46Z",
            "id": "IN-MAL-2026-010479",
            "import_time": "2026-07-14T06:49:56.85114369Z"
        }
    ]
}
References
Credits

Affected packages

npm / web-pop

Package

Name
web-pop
View open source insights on deps.dev
Purl
pkg:npm/web-pop

Affected ranges

Affected versions

2.*
2.3.5

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "f921f38e15fe101d066751e6bb2f24027022e8133946d4a47bcc835b1fc966e99936df",
            "sha256": "fc61b0ed62e346bfbb5e1e093e475d8b3065247dc8d315f0ea4e7cafd9661bad",
            "path": "lib/initializeCaller.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "web-pop-2.3.5.tgz",
            "hashes": {
                "sha512_sri": "sha512-kjbDPiqz/yHSTuR2fKvOQq5+OqYSKUZt69kPVsE0SbXohih+yMqN52RkgjWvLIVXIE+aebKbEBCjHLVSXLB1NA==",
                "sha1": "bbd43d50792b0dba2c2c9a4a0497a832521d81ea"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/web-pop/MAL-2026-10575.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]