MAL-2026-11070

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/whs4_deu/MAL-2026-11070.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-11070

Published

2026-07-25T16:15:37Z

Modified

2026-08-11T18:00:11.602349507Z

Summary

Malicious code in whs4_deu (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (2d5a7dc2cf8fe83229aec6f45e6008ce2b353039a87607b930eb44928f97538c)

package.json declares a postinstall hook that runs index.js on npm install. On execution, index.js POSTs the installer's absolute __filename path (which typically embeds the OS username and directory layout), Node.js version, and platform/architecture to a hardcoded Discord webhook at discord.com/api/webhooks/1530599209269465319/. The destination is not caller-configurable, the behavior is undocumented, and the webhook URL literal is split via string concatenation to evade trivial grep for the full endpoint. The package ships no other functionality consistent with its name; the install-time beacon is the sole observable behavior.

Source: ossf-package-analysis (96d7709dc56eae4bfe07031da42425b4a94a169255cd7b3bde0f31f0516e0fb0)

The OpenSSF Package Analysis project identified 'whs4_deu' @ 1.0.1 (npm) as malicious.

It is considered malicious because:

The package communicates with a domain associated with malicious activity.

Database specific

{
    "malicious-packages-origins": [
        {
            "import_time": "2026-07-27T01:42:43.828991489Z",
            "sha256": "96d7709dc56eae4bfe07031da42425b4a94a169255cd7b3bde0f31f0516e0fb0",
            "modified_time": "2026-07-25T16:15:37Z",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.1"
            ]
        },
        {
            "import_time": "2026-08-04T22:30:05.712640939Z",
            "sha256": "5cb5c50b57f755039aeebab19cba308fd86dad10eddad29a94ab09396fdfe6f5",
            "modified_time": "2026-08-04T21:49:34Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-011219",
            "versions": [
                "1.0.1"
            ]
        },
        {
            "import_time": "2026-08-11T17:51:59.301984006Z",
            "source": "amazon-inspector",
            "modified_time": "2026-08-11T17:24:27Z",
            "sha256": "2d5a7dc2cf8fe83229aec6f45e6008ce2b353039a87607b930eb44928f97538c",
            "id": "IN-MAL-2026-017377",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com
- OpenSSF: Package Analysis - FINDER
- - https://github.com/ossf/package-analysis
  - https://openssf.slack.com/channels/package_analysis

Affected packages

npm / whs4_deu

Package

Name: whs4_deu; View open source insights on deps.dev
Purl: pkg:npm/whs4_deu

Affected ranges

Affected versions

1.*

1.0.0

1.0.1

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/whs4_deu/MAL-2026-11070.json"

indicators

{
    "evidence_files": [
        {
            "sha256": "3027b7cb1b01364006bd3b88e0a1bed9822e2cff64dbbf83e5e0dbf0b4b07dd4",
            "tlsh": "0061518a96f022210bb3f3d4204bc12bbb2985132a0ecd45f64c47b41fce67dd4e52e8",
            "path": "index.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "whs4_deu-1.0.1.tgz",
            "hashes": {
                "sha1": "b37e6a0cbef42e7b4ac1e3bbbf47acd3f2161f17",
                "sha512_sri": "sha512-s1LLJrHj4H53FsnBatcpEzck+5ANO9P/E+wlrD+XRXzbE9phPLAX24dXX4xEPmjlj0yJXZYoz4Rnsjr1kRnqQQ=="
            }
        }
    ]
}

cwes

[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]