MAL-2026-13618

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/w-screenctl/MAL-2026-13618.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13618
Published
2026-08-07T16:37:30Z
Modified
2026-08-07T17:04:53.389344220Z
Summary
Malicious code in w-screenctl (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3b2f241eacc2eaaaac28d2b9d76aeb67042a109869b28e45a88648bf937f856f)

When WScreenctl() is invoked (via the bundled g.mjs entry or the documented systemd/Task Scheduler service units), the package starts a Hapi HTTP server bound to 0.0.0.0:7000 with CORS enabled and no authentication. POST /chrome/evaluate passes the request body's script field directly to Playwright's page.evaluate, allowing arbitrary JavaScript execution inside the controlled Chrome instance. POST /keyboard/type, /keyboard/key, and /mouse/* forward HTTP-supplied text, key names, and coordinates into xdotool or w-mousekey/AHK, driving system-wide keyboard and mouse input on the host desktop. Because the listener binds to all interfaces with no credential check, any party reachable on the network — LAN, adjacent VLAN, or an internet-routable interface — can execute JavaScript in the browser session and drive arbitrary keystrokes and clicks on the operator's machine, which can be used to open a terminal, type shell commands, and achieve full host RCE. The dist bundle also contains child_process usage tied to ping and POST primitives consistent with this HTTP dispatch surface.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "1.0.6"
            ],
            "id": "IN-MAL-2026-017112",
            "import_time": "2026-08-07T16:51:14.781923366Z",
            "modified_time": "2026-08-07T16:37:30Z",
            "source": "amazon-inspector",
            "sha256": "3b2f241eacc2eaaaac28d2b9d76aeb67042a109869b28e45a88648bf937f856f"
        },
        {
            "versions": [
                "1.0.4"
            ],
            "id": "IN-MAL-2026-017114",
            "import_time": "2026-08-07T16:51:14.986569827Z",
            "modified_time": "2026-08-07T16:37:47Z",
            "source": "amazon-inspector",
            "sha256": "cfbb40fea41b3fe5dded40f87d00777d79eda90d034f1e636db7eff4c66d4f70"
        },
        {
            "versions": [
                "1.0.7"
            ],
            "id": "IN-MAL-2026-017113",
            "import_time": "2026-08-07T16:51:14.891590759Z",
            "modified_time": "2026-08-07T16:37:37Z",
            "source": "amazon-inspector",
            "sha256": "fb31a66477cc291553e3123de783c519b6eedba6b6168f6b4d3e90a5a293a437"
        }
    ]
}
References
Credits

Affected packages

npm / w-screenctl

Package

Name
w-screenctl
View open source insights on deps.dev
Purl
pkg:npm/w-screenctl

Affected ranges

Affected versions

1.*
1.0.4
1.0.6
1.0.7

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-tWtg49r340m9ZSCP1e0+PA4g/6OehjSdthVF8XMzJb8Yd4yu3O3HCH47Nxeo+rHPcc3Z7q1RCwXdiQufYlcYIg==",
                "sha1": "e6ce9dc206126a777ef8ec434932d28aad26eb88"
            },
            "filename": "w-screenctl-1.0.6.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "src/WScreenctl.mjs",
            "tlsh": "6c5260ba507a141a3f53fbae546f90082664b4033c196a92be5c73202fcd92d61f9ff5",
            "sha256": "be376dc149a45986ed15a292fd0cd9327171c80707f0bd85e6d57aab6264d1ac"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/w-screenctl/MAL-2026-13618.json"