{"id":"MAL-2026-12005","summary":"Malicious code in webdev-conf (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9577d9f40486af224c5dd365ffbab6a5d45c4a052dfe6de50bc1d8f130d9642a)\nwebdev-conf@5.0.0 is a typosquat of the sindresorhus/pkg-conf library, published under author 'Sinde Sorus' \u003csindesorus@gmail.com\u003e (homoglyph of Sindre Sorhus). index.js appends an eval(atob(...)) block after the legitimate library code. On require(), the decoded payload queries public Ethereum RPC endpoints and blockscout.com/api for the latest transaction sent from the attacker address 0xa322E5f3D311D3080e6f01210263e9aDC2490Ef1, extracts an IP address from that transaction, then fetches XOR-encrypted next-stage JavaScript from http://\u003cIP\u003e:443/0x/cls and http://\u003cIP\u003e:443/0x/ls, eval()s it in-process, and re-executes it via spawn('node', ['-e', payload], {detached:true, windowsHide:true}).unref(). Identifiers such as http, https, child_process, spawn, and the RPC URLs are hidden with \\uXXXX unicode escapes. The C2 IP is rotatable by the attacker via on-chain transactions (EtherHiding technique). Any package that require()s webdev-conf triggers remote code execution on the installer's host.\n","modified":"2026-08-05T00:38:10.360431400Z","published":"2026-08-04T23:57:12Z","database_specific":{"malicious-packages-origins":[{"versions":["5.0.0"],"id":"IN-MAL-2026-011359","import_time":"2026-08-05T00:04:38.694650379Z","modified_time":"2026-08-04T23:57:12Z","sha256":"9577d9f40486af224c5dd365ffbab6a5d45c4a052dfe6de50bc1d8f130d9642a","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/webdev-conf/v/5.0.0"}],"affected":[{"package":{"name":"webdev-conf","ecosystem":"npm","purl":"pkg:npm/webdev-conf"},"versions":["5.0.0"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"sha256":"9f1e75859e696811640fc348a0e7dfe664ed5dcd95017eacd7d6cdf3b3025d46","tlsh":"ea521daa4692bb9bcb1b2673fc87570d237840b67a9c2b45310fd874b389c55748e60f","path":"index.js"},{"sha256":"a999c4f3ed5d91129e457e2c1d85d6e9bee0018306ec3698f9268fa948603d16","tlsh":"6a01f113852dded303d8aaec9c5ed4c7506f505228c69cee8cd3f634c2ec151128b156","path":"package.json"}],"package_integrity":[{"filename":"webdev-conf-5.0.0.tgz","hashes":{"sha1":"8e679576b51036735148dea39c01b29c65773229","sha512_sri":"sha512-oAnxnTtmyuLw5yHEmj37JWq09sEl1nCkvAx5EfkSvzGkcZy1pAw8WgMslFbb4qVQwSzdwW9Sf7TIuMu93QsJmw=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/webdev-conf/MAL-2026-12005.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}