{"id":"MAL-2026-13618","summary":"Malicious code in w-screenctl (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3b2f241eacc2eaaaac28d2b9d76aeb67042a109869b28e45a88648bf937f856f)\nWhen WScreenctl() is invoked (via the bundled g.mjs entry or the documented systemd/Task Scheduler service units), the package starts a Hapi HTTP server bound to 0.0.0.0:7000 with CORS enabled and no authentication. POST /chrome/evaluate passes the request body's `script` field directly to Playwright's page.evaluate, allowing arbitrary JavaScript execution inside the controlled Chrome instance. POST /keyboard/type, /keyboard/key, and /mouse/* forward HTTP-supplied text, key names, and coordinates into xdotool or w-mousekey/AHK, driving system-wide keyboard and mouse input on the host desktop. Because the listener binds to all interfaces with no credential check, any party reachable on the network — LAN, adjacent VLAN, or an internet-routable interface — can execute JavaScript in the browser session and drive arbitrary keystrokes and clicks on the operator's machine, which can be used to open a terminal, type shell commands, and achieve full host RCE. The dist bundle also contains child_process usage tied to ping and POST primitives consistent with this HTTP dispatch surface.\n","modified":"2026-08-07T17:04:53.389344220Z","published":"2026-08-07T16:37:30Z","database_specific":{"malicious-packages-origins":[{"versions":["1.0.6"],"id":"IN-MAL-2026-017112","import_time":"2026-08-07T16:51:14.781923366Z","modified_time":"2026-08-07T16:37:30Z","sha256":"3b2f241eacc2eaaaac28d2b9d76aeb67042a109869b28e45a88648bf937f856f","source":"amazon-inspector"},{"id":"IN-MAL-2026-017114","import_time":"2026-08-07T16:51:14.986569827Z","modified_time":"2026-08-07T16:37:47Z","sha256":"cfbb40fea41b3fe5dded40f87d00777d79eda90d034f1e636db7eff4c66d4f70","source":"amazon-inspector","versions":["1.0.4"]},{"sha256":"fb31a66477cc291553e3123de783c519b6eedba6b6168f6b4d3e90a5a293a437","source":"amazon-inspector","versions":["1.0.7"],"id":"IN-MAL-2026-017113","import_time":"2026-08-07T16:51:14.891590759Z","modified_time":"2026-08-07T16:37:37Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/w-screenctl/v/1.0.6"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/w-screenctl/v/1.0.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/w-screenctl/v/1.0.7"}],"affected":[{"package":{"name":"w-screenctl","ecosystem":"npm","purl":"pkg:npm/w-screenctl"},"versions":["1.0.6","1.0.4","1.0.7"],"database_specific":{"indicators":{"package_integrity":[{"hashes":{"sha1":"e6ce9dc206126a777ef8ec434932d28aad26eb88","sha512_sri":"sha512-tWtg49r340m9ZSCP1e0+PA4g/6OehjSdthVF8XMzJb8Yd4yu3O3HCH47Nxeo+rHPcc3Z7q1RCwXdiQufYlcYIg=="},"filename":"w-screenctl-1.0.6.tgz"}],"evidence_files":[{"tlsh":"6c5260ba507a141a3f53fbae546f90082664b4033c196a92be5c73202fcd92d61f9ff5","path":"src/WScreenctl.mjs","sha256":"be376dc149a45986ed15a292fd0cd9327171c80707f0bd85e6d57aab6264d1ac"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/w-screenctl/MAL-2026-13618.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}