mal-2026-16354
Vulnerability from ossf_malicious_packages
Published
2026-09-21 17:20
Modified
2026-09-23 01:30
Summary
Malicious code in @woodpecker-web-shared/components (npm)
Details
-= Per source details. Do not edit below this line.=-
Source: amazon-inspector (5f5f21bcc5464689c5b7c70819eeca4ea481f76b5f7dac0358cfe2d967da235f)
On npm install, the package's postinstall hook runs node index.js, which collects installer host identifiers (os.hostname(), os.userInfo().username, os.platform(), architecture, cwd, node version, npm_lifecycle_event) and POSTs them as JSON to a hardcoded third-party collector at https://webhook.site/d9bc4bcc-ce74-4193-ae4e-96d234bb2220. The payload includes a src: 'loMesb' tag consistent with a campaign identifier used to correlate exfiltrated data across victims. The @woodpecker-web-shared/components scope/name has no legitimate reason to transmit installer identity to an anonymous webhook collector at install time, and the behavior fires automatically without user interaction. This is a recon beacon consistent with a dependency-confusion or typosquat lure.
CWE
Credits
{
"affected": [
{
"database_specific": {
"cwes": [
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
}
],
"indicators": {
"evidence_files": [
{
"path": "index.js",
"sha256": "571921b899cc452ceb5461b866cce0bfb23c19ecf7a32215da036e2239df6589",
"tlsh": "192120e64cf0942016e7aec86143fc25b292d0076c06fc98fa5d03661fecdac94726f8"
}
],
"package_integrity": [
{
"filename": "components-2.20.5.tgz",
"hashes": {
"sha1": "99628436217844467b42c6fb867f091578ffaca5",
"sha512_sri": "sha512-MLex1qkO/zryhJHylLj1tUkhwPjs9f2fv0qgk+djgJidlpSSoUyVTua5z5gbxA8hnjWwtw6jgGez4ALGz0J93Q=="
}
}
]
}
},
"package": {
"ecosystem": "npm",
"name": "@woodpecker-web-shared/components"
},
"versions": [
"2.20.5",
"4.20.5",
"1.20.4"
]
}
],
"credits": [
{
"contact": [
"inspector-research@amazon.com"
],
"name": "Amazon Inspector",
"type": "FINDER"
}
],
"database_specific": {
"malicious-packages-origins": [
{
"id": "IN-MAL-2026-020265",
"import_time": "2026-09-21T17:38:31.850783863Z",
"modified_time": "2026-09-21T17:20:37Z",
"sha256": "5f5f21bcc5464689c5b7c70819eeca4ea481f76b5f7dac0358cfe2d967da235f",
"source": "amazon-inspector",
"versions": [
"2.20.5"
]
},
{
"id": "IN-MAL-2026-020319",
"import_time": "2026-09-23T01:28:36.061321308Z",
"modified_time": "2026-09-23T00:57:43Z",
"sha256": "1b555b1ba3b71b1d8d4331cb66ba7d95e5bb16fb1d92f606a6c1cc0a3ab2f251",
"source": "amazon-inspector",
"versions": [
"4.20.5"
]
},
{
"id": "IN-MAL-2026-020318",
"import_time": "2026-09-23T01:28:35.977726098Z",
"modified_time": "2026-09-23T00:57:28Z",
"sha256": "499bf987e986573336604e51238016f2425a0cf9eb2b703160e36d26befcf2f1",
"source": "amazon-inspector",
"versions": [
"1.20.4"
]
}
]
},
"details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5f5f21bcc5464689c5b7c70819eeca4ea481f76b5f7dac0358cfe2d967da235f)\nOn `npm install`, the package\u0027s postinstall hook runs `node index.js`, which collects installer host identifiers (os.hostname(), os.userInfo().username, os.platform(), architecture, cwd, node version, npm_lifecycle_event) and POSTs them as JSON to a hardcoded third-party collector at https://webhook.site/d9bc4bcc-ce74-4193-ae4e-96d234bb2220. The payload includes a `src: \u0027loMesb\u0027` tag consistent with a campaign identifier used to correlate exfiltrated data across victims. The @woodpecker-web-shared/components scope/name has no legitimate reason to transmit installer identity to an anonymous webhook collector at install time, and the behavior fires automatically without user interaction. This is a recon beacon consistent with a dependency-confusion or typosquat lure.\n",
"id": "MAL-2026-16354",
"modified": "2026-09-23T01:30:22.779143860Z",
"published": "2026-09-21T17:20:37Z",
"references": [
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@woodpecker-web-shared/components/v/2.20.5"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@woodpecker-web-shared/components/v/4.20.5"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/@woodpecker-web-shared/components/v/1.20.4"
}
],
"schema_version": "1.7.4",
"summary": "Malicious code in @woodpecker-web-shared/components (npm)"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…