{"id":"MAL-2026-12327","summary":"Malicious code in @offa-uwk/offa-uwk (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (115f62b574a9c9c91a35c6a489b74a38d6132b4d8e706deb388d2f6df1dc32f2)\nOn `npm install`, the package's postinstall script (`node index.js`) collects host identifiers (`os.hostname()`, `os.userInfo().username`, `process.cwd()`) and POSTs them via HTTPS to a hardcoded webhook.site collector at `https://webhook.site/e6b10849-38dc-4280-a8e3-72ab39cfaf65`. Immediately after the beacon, the script executes `shutdown -h now` with a fallback of `systemctl poweroff`, forcibly powering off the installing host. A preinstall step also writes a marker file to the absolute path `/home/OFFA/flag`, outside the package directory. Package metadata (name `@offa-uwk/offa-uwk`, version `999.0.6`) is consistent with a proof-of-concept malicious artifact.\n","modified":"2026-08-05T13:35:13.040452093Z","published":"2026-08-05T12:45:09Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-05T13:08:42.982888256Z","modified_time":"2026-08-05T12:45:09Z","sha256":"115f62b574a9c9c91a35c6a489b74a38d6132b4d8e706deb388d2f6df1dc32f2","source":"amazon-inspector","versions":["999.0.6"],"id":"IN-MAL-2026-014746"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@offa-uwk/offa-uwk/v/999.0.6"}],"affected":[{"package":{"name":"@offa-uwk/offa-uwk","ecosystem":"npm","purl":"pkg:npm/%40offa-uwk/offa-uwk"},"versions":["999.0.6"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"hashes":{"sha1":"187ed337d2037af38adc0e691c14f963cbb7aca0","sha512_sri":"sha512-kRYYQhn2hWYjPYxtXi1220Hm2/mrDLwjB5pAsPsfisbR1mN5H4d8ji+++eF2OQld3sED2FGnsYuXjnPrJGAGPw=="},"filename":"offa-uwk-999.0.6.tgz"}],"evidence_files":[{"sha256":"0704d1cefad87e554993e01a20236708da1b46075e24907448d13c8ecb12f277","tlsh":"d83114e005b25270a7b320d5e50b781eb1b3c4077245ed20b9dc8358bfc94b8dab6af5","path":"index.js"},{"tlsh":"08d0c2304e10992369c057aa0837a4467aa14e1780547c04a7eb122841dbbbb44ffb3e","path":"package.json","sha256":"fefbf451abc700e90ebd5b41d444085af6557a63523d1ce01b0c2f9ab5911946"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@offa-uwk/offa-uwk/MAL-2026-12327.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}