{"id":"MAL-2026-13948","summary":"Malicious code in debug-proxy-chrome-devtools (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b7a0986932a47f49b162ea0438acfd0b6293e027e8ac2da46eb1221c5d52646c)\ndebug-proxy-chrome-devtools@1.0.1 declares a postinstall hook (`\"postinstall\": \"node install.js\"`) that automatically executes on `npm install`. install.js uses `child_process.execSync` to run `whoami` on the installer's machine and then issues an `https.get` to a hardcoded webhook.site collector (`https://webhook.site/cfe35ac2-bec3-48b8-bae1-a49dea5412c2`), passing the captured command output and hostname/command identifiers as URL query parameters. The package advertises itself as a Chrome DevTools debug proxy; that stated purpose has no need for shell reconnaissance or beaconing to a third-party request-inspection service. The combination of automatic install-time execution, capture of installer-side identity data, and a hardcoded non-first-party exfiltration endpoint matches the reconnaissance/beacon shape of a malicious postinstall payload.\n","modified":"2026-08-13T17:30:12.539570073Z","published":"2026-08-13T17:16:22Z","database_specific":{"malicious-packages-origins":[{"versions":["1.0.2"],"id":"IN-MAL-2026-017639","import_time":"2026-08-13T17:24:45.474239794Z","modified_time":"2026-08-13T17:16:22Z","sha256":"00be2900d37e73a700651b4dfb9f6d61d41e8b5a7a6d44d073b77f1184ba415f","source":"amazon-inspector"},{"source":"amazon-inspector","versions":["1.0.1"],"id":"IN-MAL-2026-017654","import_time":"2026-08-13T17:24:46.110526876Z","modified_time":"2026-08-13T17:21:15Z","sha256":"b7a0986932a47f49b162ea0438acfd0b6293e027e8ac2da46eb1221c5d52646c"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/debug-proxy-chrome-devtools/v/1.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/debug-proxy-chrome-devtools/v/1.0.1"}],"affected":[{"package":{"name":"debug-proxy-chrome-devtools","ecosystem":"npm","purl":"pkg:npm/debug-proxy-chrome-devtools"},"versions":["1.0.2","1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"debug-proxy-chrome-devtools-1.0.2.tgz","hashes":{"sha1":"209014de5abedc5f5c9437103451b82859549c91","sha512_sri":"sha512-4rWK2o8tqPOfpXKIYJwPiseczmWDASUoLQnyFzSVIy1ipFnOSUUQN22BR+GI5Tq1YSi3lKbWtaUMaGsc64hMcA=="}}],"evidence_files":[{"sha256":"4e51f1478473f933d6485798772b454d6903c09f446222ebdf685505199315e7","tlsh":"d33175a9c6f57a2062a1b1b0b2a78409fda38353b11e3c9cf2cd4b285b4fd6460313d9","path":"install.js"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/debug-proxy-chrome-devtools/MAL-2026-13948.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}