{"id":"MAL-2026-18445","summary":"Malicious code in self-v8 (npm)","details":"Malicious package. `self-v8` is an npm package that harvests sensitive data on the victim host and exfiltrates it to an attacker-controlled Discord webhook. Classification: information stealer. The package provides no legitimate functionality, so all published versions are malicious. Full indicators are published at the reference below.","modified":"2026-11-02T05:00:05.964247329Z","published":"2026-10-29T00:00:00Z","database_specific":{"iocs":{"urls":["https://discord.com/api/webhooks/1450251813067423817/"]}},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/self-v8"},{"type":"WEB","url":"https://wormsign.io/portfolio/self-v8/"}],"affected":[{"package":{"name":"self-v8","ecosystem":"npm","purl":"pkg:npm/self-v8"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.0.0","2.1.8","2.1.9","8.1.9","8.3.9","8.5.9","8.7.9","8.9.9"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/self-v8/MAL-2026-18445.json"}}],"schema_version":"1.9.2","credits":[{"name":"wormsign","contact":["https://x.com/w0rmsign"],"type":"FINDER"}]}