MAL-2026-13991

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/webautomation_js/MAL-2026-13991.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13991
Published
2026-08-13T21:38:46Z
Modified
2026-08-13T22:00:13.345624917Z
Summary
Malicious code in webautomation_js (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (854e679284d7396f5ac4f7248839fa3704a2c72bcec08c100267b5980cd2a0d5)

index.js is packed with an obfuscator.io RC4 string-array plus self-defending debugger-check wrapper. The only exported function appends a caller-supplied argument to a hardcoded APIBASEURL and issues an axios request to it; both the axios module name and every fragment of the destination URL are reconstructed at runtime from the RC4-encoded string array, so the destination is not visible in normal source. The package description ("logger tool for validation entry"), README, and empty author metadata do not disclose the destination. The documented purpose does not require a hidden remote endpoint, and legitimate HTTP client libraries do not RC4-encrypt their endpoint strings. Any caller invoking the exported function sends their argument to an attacker-controlled destination they cannot see.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017709",
            "import_time": "2026-08-13T21:50:20.167477568Z",
            "sha256": "4e620ac0a2aea29f0b5ee3e7dd04a7eccfb30e1126dd0e41da64d989fb8ac4fe",
            "modified_time": "2026-08-13T21:38:56Z",
            "source": "amazon-inspector",
            "versions": [
                "1.0.1"
            ]
        },
        {
            "import_time": "2026-08-13T21:50:20.095255767Z",
            "id": "IN-MAL-2026-017708",
            "sha256": "854e679284d7396f5ac4f7248839fa3704a2c72bcec08c100267b5980cd2a0d5",
            "modified_time": "2026-08-13T21:38:46Z",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / webautomation_js

Package

Name
webautomation_js
View open source insights on deps.dev
Purl
pkg:npm/webautomation_js

Affected ranges

Affected versions

1.*
1.0.0
1.0.1

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "tlsh": "35d0957774c1111a877127a041ef2905330761fc7e0023d47254d5373519dd56842ffd",
            "sha256": "b1effec9823fe570bc231d1fa2a6b60bcfff6afdc137e787206cc5382cf10f9b"
        }
    ],
    "package_integrity": [
        {
            "filename": "webautomation_js-1.0.1.tgz",
            "hashes": {
                "sha1": "8cc2fe3b2fbf7aaf1ea624464ada426b94cc50d3",
                "sha512_sri": "sha512-wcgFmojGQkybzfvL/YyhEJHP99nUFIV8Td321HFXnvAVMCtXm4wxh8/WiU16MxpN7WHqzGhRTL5OqVAD+lCTVA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/webautomation_js/MAL-2026-13991.json"