MAL-2026-6458

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/wp-codebox-workspace/MAL-2026-6458.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6458
Published
2026-06-25T07:26:37Z
Modified
2026-06-25T08:01:27.123118534Z
Summary
Malicious code in wp-codebox-workspace (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a44aa2030ed09d6ec3998c59953a44e013c1993d93a90ee031b0999480afb03c)

Package is published at version 9999.99.99 with a description referencing an 'npm 404 error referenced in Extra-Chill/homeboy-extensions' — the textbook dependency-confusion shape, where an unclaimed internal package name is registered publicly at a maximal version so private builds silently resolve to this public package. On install, postinstall.js reads npm package metadata, Node/OS info, and CI environment indicators including GITHUBREPOSITORY, GITHUBREPOSITORYOWNER, and GITHUBWORKFLOW, then POSTs them to https://ddactic-lab.online/sc/beacon. A DNS-lookup fallback encodes the package slug, CI provider, and a hash into a subdomain label under b.ddactic-lab.online, with an in-source comment stating the channel exists to fire 'even through HTTP-blocking corporate proxies' — explicit intent to evade installer egress controls. The combined effect: any private CI build that mistakenly resolves this name leaks the victim organization's private repository, owner, and workflow identifiers to an attacker-controlled host, with a covert DNS fallback for environments that block HTTP.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-007507",
            "source": "amazon-inspector",
            "import_time": "2026-06-25T07:47:52.732044788Z",
            "modified_time": "2026-06-25T07:26:37Z",
            "sha256": "a44aa2030ed09d6ec3998c59953a44e013c1993d93a90ee031b0999480afb03c",
            "versions": [
                "9999.99.99"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / wp-codebox-workspace

Package

Name
wp-codebox-workspace
View open source insights on deps.dev
Purl
pkg:npm/wp-codebox-workspace

Affected ranges

Affected versions

9999.*
9999.99.99

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "4516ba2b672e742658b040a522d3e9cc7e4c1346578edba6cad57cffca9fa0a2",
            "path": "package.json",
            "tlsh": "a5f027004aa45b636ee836858d6a0286f7324c4b808c7c173beb451c47deba710bf15d"
        },
        {
            "sha256": "e5c7efaa25bd6fc20c40fe6e39a40957043022e78b5ec6d9ad2b9e49a3ef75c8",
            "path": "postinstall.js",
            "tlsh": "e241a755829891340fe122c9b852c8165d7bd49633e799f0774d15226fc92bc03b2fdf"
        }
    ],
    "package_integrity": [
        {
            "filename": "wp-codebox-workspace-9999.99.99.tgz",
            "hashes": {
                "sha1": "4b0d86d4336e5e214442e956b868af27a1a08ca3",
                "sha512_sri": "sha512-0Zxe6cpbv2drlgHveqXoaF3jjDzmYZR+M3aO7oE0ujVrp3cDcUfTOoVJ7ExfbWqwP9J4OwCEkXhlGR/xRrPwXQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/wp-codebox-workspace/MAL-2026-6458.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]