{"id":"MAL-2026-4461","summary":"Malicious code in @venturo/playwright (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0e9a29f430bb3a664936cb27d7cc0dc6f3e8764ae0fae7e9fc8e001fcece43c8)\n@venturo/playwright impersonates Microsoft's @playwright/test: package.json sets author to 'Microsoft Corporation', homepage to 'https://playwright.dev', and repository to 'microsoft/playwright', while the source is a near-verbatim copy of @playwright/test's API surface. The package declares a single dependency 'venturo-playwright-core: 1.0.9' — a non-Microsoft package under an unrelated namespace — which npm install silently pulls into the installer's dependency tree. Notably, the code itself (index.js, index.mjs, lib/index.js, lib/program.js) requires 'playwright-core' rather than 'venturo-playwright-core', so this tarball only functions when Microsoft's real playwright-core is already resolvable — but installation still grafts the attacker-controlled venturo-playwright-core into the dependency graph. Whatever code that sibling ships at install/require time is delivered to every installer of this package; the Microsoft attribution is the cover story that makes installers trust the lure.\n","modified":"2026-05-27T00:31:51.669511578Z","published":"2026-05-20T01:57:26Z","withdrawn":"2026-05-26T19:49:27Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-05-26T05:50:32.874547846Z","modified_time":"2026-05-20T01:57:26Z","sha256":"0e9a29f430bb3a664936cb27d7cc0dc6f3e8764ae0fae7e9fc8e001fcece43c8","source":"amazon-inspector","versions":["1.1.0"],"id":"IN-MAL-2026-003388"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@venturo/playwright/v/1.1.0"}],"affected":[{"package":{"name":"@venturo/playwright","ecosystem":"npm","purl":"pkg:npm/%40venturo%2Fplaywright"},"versions":["1.1.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/withdrawn/npm/@venturo/playwright/MAL-2026-4461.json","indicators":{"evidence_files":[{"sha256":"3091e108cd87bd56a02a7d177395fba28f4f89c64d1121c8d53a364f2cc4d79f","tlsh":"39310422c5e94d4321853a6aeaae8522b175c98f44147f0537ca05ac8f8d6bf51fe30d","path":"package.json"},{"tlsh":"36f0d37d39443773178085fb7e1fc0cfb159c199315f9385281a81e50d2d5aa02e8df0","path":"index.js","sha256":"4e98f65f0a9d9bcab8cffc0c5cfdd87fd3f5b0be74fc494ff166a466b204cd44"}],"package_integrity":[{"filename":"playwright-1.1.0.tgz","hashes":{"sha1":"74881e77e8a98f1f8544bcbf148cd8d341d7812c","sha512_sri":"sha512-y16trCVgFl3Fwlo8t2Iu9XJIEjIfL5DsLS/XhmhsOFWeGiyJ0kUo/REtp6J4zdyJwMOLMo/HaJCbMRlp1YDCEg=="}}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"}]}