{"id":"MAL-2026-16354","summary":"Malicious code in @woodpecker-web-shared/components (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5f5f21bcc5464689c5b7c70819eeca4ea481f76b5f7dac0358cfe2d967da235f)\nOn `npm install`, the package's postinstall hook runs `node index.js`, which collects installer host identifiers (os.hostname(), os.userInfo().username, os.platform(), architecture, cwd, node version, npm_lifecycle_event) and POSTs them as JSON to a hardcoded third-party collector at https://webhook.site/d9bc4bcc-ce74-4193-ae4e-96d234bb2220. The payload includes a `src: 'loMesb'` tag consistent with a campaign identifier used to correlate exfiltrated data across victims. The @woodpecker-web-shared/components scope/name has no legitimate reason to transmit installer identity to an anonymous webhook collector at install time, and the behavior fires automatically without user interaction. This is a recon beacon consistent with a dependency-confusion or typosquat lure.\n","modified":"2026-09-21T17:45:06.258540965Z","published":"2026-09-21T17:20:37Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-09-21T17:38:31.850783863Z","modified_time":"2026-09-21T17:20:37Z","sha256":"5f5f21bcc5464689c5b7c70819eeca4ea481f76b5f7dac0358cfe2d967da235f","source":"amazon-inspector","versions":["2.20.5"],"id":"IN-MAL-2026-020265"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@woodpecker-web-shared/components/v/2.20.5"}],"affected":[{"package":{"name":"@woodpecker-web-shared/components","ecosystem":"npm","purl":"pkg:npm/%40woodpecker-web-shared/components"},"versions":["2.20.5"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@woodpecker-web-shared/components/MAL-2026-16354.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"tlsh":"192120e64cf0942016e7aec86143fc25b292d0076c06fc98fa5d03661fecdac94726f8","path":"index.js","sha256":"571921b899cc452ceb5461b866cce0bfb23c19ecf7a32215da036e2239df6589"}],"package_integrity":[{"filename":"components-2.20.5.tgz","hashes":{"sha1":"99628436217844467b42c6fb867f091578ffaca5","sha512_sri":"sha512-MLex1qkO/zryhJHylLj1tUkhwPjs9f2fv0qgk+djgJidlpSSoUyVTua5z5gbxA8hnjWwtw6jgGez4ALGz0J93Q=="}}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}