MAL-2026-13743

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/whs4_ued/MAL-2026-13743.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13743
Published
2026-08-11T17:24:09Z
Modified
2026-08-11T18:00:11.569845999Z
Summary
Malicious code in whs4_ued (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (6be723a2156cdb77cc97a0afb9ee15e4d50928a1924cd6cde69bcaacf2707a8b)

On npm install, the package's postinstall hook runs node index.js, which POSTs installer host information — the absolute path of the package file (leaking the OS username and home directory layout), Node.js version, platform, and architecture — to a hardcoded Discord webhook at discord.com/api/webhooks/1530599209269465319/. The webhook token is assembled via string concatenation at the call site to evade naive string matching. The destination is attacker-controlled and unrelated to the package's stated educational typo-catcher purpose, and there is no consent gate.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-11T17:51:59.184682055Z",
            "id": "IN-MAL-2026-017375",
            "sha256": "6be723a2156cdb77cc97a0afb9ee15e4d50928a1924cd6cde69bcaacf2707a8b",
            "modified_time": "2026-08-11T17:24:09Z",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / whs4_ued

Package

Name
whs4_ued
View open source insights on deps.dev
Purl
pkg:npm/whs4_ued

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "tlsh": "3a61518a96f022214ba3f3d4604bc12bbb2985132a0ecd45f64c47b41fce67dd4e52e8",
            "sha256": "2ea6b8cda775d8d5fab218c99e9663f69b8d67929e420f2f75a4139cdc778670"
        }
    ],
    "package_integrity": [
        {
            "filename": "whs4_ued-1.0.0.tgz",
            "hashes": {
                "sha1": "079d5390ebaa82b529fb9dc6f790551b9b6a4ad2",
                "sha512_sri": "sha512-caJpHmJpE+t9YD+nBxcHVFKF52p7G5fH3ZMA+TKHtH+GcIWlQ2t51qO2xq17jLMsPtl0PafCo8WbYu6gzb6LjA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/whs4_ued/MAL-2026-13743.json"