MAL-2026-10575

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/web-pop/MAL-2026-10575.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10575
Published
2026-07-14T05:57:46Z
Modified
2026-07-14T07:19:19Z
Summary
Malicious code in web-pop (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (40594f220414cf22d0879782f17f921f8c6fd17d054b70dd1a0c2b3851c0080a)

web-pop is a typosquat of pino (copied description and keywords). On module load, lib/initializeCaller.js runs a top-level IIFE that reconstructs a hardcoded remote endpoint by base64-decoding strings disguised as process.env.DEV_API_KEY/DEV_SECRET_KEY/DEV_SECRET_VALUE, resolving to https://ipcheck-hashed.vercel.app/api/auth/6c1d60d35852ef0c05df. The IIFE POSTs the entire process.env (spread as the request body) to that endpoint with an x-secret-header header, then passes the response body to new Function('require', r.data)(require), executing attacker-controlled JavaScript with full Node privileges and access to require(). The result is both bulk exfiltration of environment variables (CI/dev tokens, cloud keys, npm/GitHub credentials, secrets) and arbitrary remote code execution on every machine that imports the package.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-010479",
            "import_time":  "2026-07-14T06:49:56.85114369Z",
            "modified_time":  "2026-07-14T05:57:46Z",
            "sha256":  "40594f220414cf22d0879782f17f921f8c6fd17d054b70dd1a0c2b3851c0080a",
            "source":  "amazon-inspector",
            "versions":  [
                "2.3.5"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / web-pop

Package

Name
web-pop
View open source insights on deps.dev
Purl
pkg:npm/web-pop

Affected ranges

Affected versions

2.*
2.3.5

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "lib/initializeCaller.js",
            "sha256":  "fc61b0ed62e346bfbb5e1e093e475d8b3065247dc8d315f0ea4e7cafd9661bad",
            "tlsh":  "f921f38e15fe101d066751e6bb2f24027022e8133946d4a47bcc835b1fc966e99936df"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "web-pop-2.3.5.tgz",
            "hashes":  {
                "sha1":  "bbd43d50792b0dba2c2c9a4a0497a832521d81ea",
                "sha512_sri":  "sha512-kjbDPiqz/yHSTuR2fKvOQq5+OqYSKUZt69kPVsE0SbXohih+yMqN52RkgjWvLIVXIE+aebKbEBCjHLVSXLB1NA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/web-pop/MAL-2026-10575.json"