{"id":"MAL-2026-10575","summary":"Malicious code in web-pop (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (40594f220414cf22d0879782f17f921f8c6fd17d054b70dd1a0c2b3851c0080a)\nweb-pop is a typosquat of pino (copied description and keywords). On module load, lib/initializeCaller.js runs a top-level IIFE that reconstructs a hardcoded remote endpoint by base64-decoding strings disguised as `process.env.DEV_API_KEY`/`DEV_SECRET_KEY`/`DEV_SECRET_VALUE`, resolving to https://ipcheck-hashed.vercel.app/api/auth/6c1d60d35852ef0c05df. The IIFE POSTs the entire process.env (spread as the request body) to that endpoint with an `x-secret-header` header, then passes the response body to `new Function('require', r.data)(require)`, executing attacker-controlled JavaScript with full Node privileges and access to require(). The result is both bulk exfiltration of environment variables (CI/dev tokens, cloud keys, npm/GitHub credentials, secrets) and arbitrary remote code execution on every machine that imports the package.\n","modified":"2026-07-14T07:19:19.477223084Z","published":"2026-07-14T05:57:46Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["2.3.5"],"id":"IN-MAL-2026-010479","import_time":"2026-07-14T06:49:56.85114369Z","modified_time":"2026-07-14T05:57:46Z","sha256":"40594f220414cf22d0879782f17f921f8c6fd17d054b70dd1a0c2b3851c0080a"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/web-pop/v/2.3.5"}],"affected":[{"package":{"name":"web-pop","ecosystem":"npm","purl":"pkg:npm/web-pop"},"versions":["2.3.5"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"package_integrity":[{"filename":"web-pop-2.3.5.tgz","hashes":{"sha1":"bbd43d50792b0dba2c2c9a4a0497a832521d81ea","sha512_sri":"sha512-kjbDPiqz/yHSTuR2fKvOQq5+OqYSKUZt69kPVsE0SbXohih+yMqN52RkgjWvLIVXIE+aebKbEBCjHLVSXLB1NA=="}}],"evidence_files":[{"path":"lib/initializeCaller.js","sha256":"fc61b0ed62e346bfbb5e1e093e475d8b3065247dc8d315f0ea4e7cafd9661bad","tlsh":"f921f38e15fe101d066751e6bb2f24027022e8133946d4a47bcc835b1fc966e99936df"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/web-pop/MAL-2026-10575.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}