MAL-2026-19228

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/zxcvb90-utils-helper/MAL-2026-19228.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-19228
Published
2026-11-13T03:58:46Z
Modified
2026-11-13T04:30:06Z
Summary
Malicious code in zxcvb90-utils-helper (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (37b270c23bd05f704fa06ea349aefd2d956af3fdcd3a851a5a7b89bc22493a12)

index.js, the package main, issues a fetch to the hardcoded third-party collector https://webhook.site/ce5b0917-ae74-44c3-8a62-8a4e5003d44d with URL-encoded contents of document.documentElement.outerHTML (truncated to 4000 characters) appended as a query parameter. The call fires at require/import time in any environment where document and fetch exist (browser bundles, jsdom, Electron), silently exfiltrating page DOM — including any secrets, tokens, or user data rendered into the page — to an attacker-controlled webhook collector. The package has no declared purpose and an empty description. package.json additionally declares a self-dependency on zxcvb90-utils-helper with an unpinned pre-release range (^0.0.0-stage), so npm install resolves and installs whatever bytes the registry currently serves for that tag, with no integrity pin.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-022771",
            "import_time": "2026-11-13T04:13:31.783690136Z",
            "modified_time": "2026-11-13T03:58:46Z",
            "sha256": "37b270c23bd05f704fa06ea349aefd2d956af3fdcd3a851a5a7b89bc22493a12",
            "source": "amazon-inspector",
            "versions": [
                "1.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / zxcvb90-utils-helper

Package

Name
zxcvb90-utils-helper
View open source insights on deps.dev
Purl
pkg:npm/zxcvb90-utils-helper

Affected ranges

Affected versions

1.*
1.0.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "aa11b9b6e9d309c0901739aa44abeae64c1a3430ba45d30805657f5a03dbeb89",
            "tlsh": "a5c09bf26610442c0fbec06c7329ba4cae5675056cc374459e9e6ee443366924500b78"
        },
        {
            "path": "package.json",
            "sha256": "06f13106e64f14faadb045eff148ba07a8fd8cc489afb393dd27f4ce90cc7427",
            "tlsh": "1ad0c21889628c7301c511a12fad8402b3905e5f21047c0963cb1428828dea3a8fe34c"
        }
    ],
    "package_integrity": [
        {
            "filename": "zxcvb90-utils-helper-1.0.1.tgz",
            "hashes": {
                "sha1": "36b178c67990aed899aa1fdd38cba3b90a9b3073",
                "sha512_sri": "sha512-D8C9ERV5Rs3EqD+tx3Yyd44guGpZ/cxsFeAMNuAAxAlEsK13IOXDHt0/YJgFRM+gWM4DjNp7cH1dY1ofF0B+hw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/zxcvb90-utils-helper/MAL-2026-19228.json"