{"id":"MAL-2026-19228","summary":"Malicious code in zxcvb90-utils-helper (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (37b270c23bd05f704fa06ea349aefd2d956af3fdcd3a851a5a7b89bc22493a12)\nindex.js, the package main, issues a fetch to the hardcoded third-party collector https://webhook.site/ce5b0917-ae74-44c3-8a62-8a4e5003d44d with URL-encoded contents of document.documentElement.outerHTML (truncated to 4000 characters) appended as a query parameter. The call fires at require/import time in any environment where document and fetch exist (browser bundles, jsdom, Electron), silently exfiltrating page DOM — including any secrets, tokens, or user data rendered into the page — to an attacker-controlled webhook collector. The package has no declared purpose and an empty description. package.json additionally declares a self-dependency on zxcvb90-utils-helper with an unpinned pre-release range (^0.0.0-stage), so npm install resolves and installs whatever bytes the registry currently serves for that tag, with no integrity pin.\n","modified":"2026-11-13T04:30:06.138768501Z","published":"2026-11-13T03:58:46Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-11-13T04:13:31.783690136Z","modified_time":"2026-11-13T03:58:46Z","sha256":"37b270c23bd05f704fa06ea349aefd2d956af3fdcd3a851a5a7b89bc22493a12","source":"amazon-inspector","versions":["1.0.1"],"id":"IN-MAL-2026-022771"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/zxcvb90-utils-helper/v/1.0.1"}],"affected":[{"package":{"name":"zxcvb90-utils-helper","ecosystem":"npm","purl":"pkg:npm/zxcvb90-utils-helper"},"versions":["1.0.1"],"database_specific":{"indicators":{"evidence_files":[{"tlsh":"a5c09bf26610442c0fbec06c7329ba4cae5675056cc374459e9e6ee443366924500b78","path":"index.js","sha256":"aa11b9b6e9d309c0901739aa44abeae64c1a3430ba45d30805657f5a03dbeb89"},{"path":"package.json","sha256":"06f13106e64f14faadb045eff148ba07a8fd8cc489afb393dd27f4ce90cc7427","tlsh":"1ad0c21889628c7301c511a12fad8402b3905e5f21047c0963cb1428828dea3a8fe34c"}],"package_integrity":[{"filename":"zxcvb90-utils-helper-1.0.1.tgz","hashes":{"sha1":"36b178c67990aed899aa1fdd38cba3b90a9b3073","sha512_sri":"sha512-D8C9ERV5Rs3EqD+tx3Yyd44guGpZ/cxsFeAMNuAAxAlEsK13IOXDHt0/YJgFRM+gWM4DjNp7cH1dY1ofF0B+hw=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/zxcvb90-utils-helper/MAL-2026-19228.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}]}}],"schema_version":"1.9.2","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}