Malicious code in chromecast-webdriver-cli (npm)
The npm package [email protected] contains malicious code that executes a postinstall script. This script collects host metadata such as hostname, platform, architecture, node version, package name, and npm lifecycle event, then sends this data to a third-party server without user consent. The package is a typosquat or dependency confusion attempt, mimicking a legitimate upstream tool but with no functional code beyond the data beacon.
AI Analysis
Technical Summary
chromecast-webdriver-cli version 1.0.0 includes a postinstall lifecycle script that automatically collects system metadata and transmits it as JSON to a hardcoded third-party endpoint (h77svwt7.instances.poc.jchunt.top). This occurs on every npm install without opt-in or any legitimate relationship to the upstream project it mimics. The package functions as a malicious beacon designed to fingerprint systems, representing a dependency confusion or typosquatting attack vector.
Potential Impact
The impact is the unauthorized collection and exfiltration of host metadata during package installation. This can lead to privacy violations and potential reconnaissance for further attacks. There is no indication of code execution beyond data collection or direct system compromise from the provided data.
Mitigation Recommendations
Users should avoid installing [email protected]. Remove the package if already installed. Use verified package sources and names to prevent typosquatting or dependency confusion attacks. Since no official fix or patch is indicated, the best mitigation is to not use this malicious package and rely on trusted upstream packages.
Malicious code in chromecast-webdriver-cli (npm)
Description
The npm package [email protected] contains malicious code that executes a postinstall script. This script collects host metadata such as hostname, platform, architecture, node version, package name, and npm lifecycle event, then sends this data to a third-party server without user consent. The package is a typosquat or dependency confusion attempt, mimicking a legitimate upstream tool but with no functional code beyond the data beacon.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
chromecast-webdriver-cli version 1.0.0 includes a postinstall lifecycle script that automatically collects system metadata and transmits it as JSON to a hardcoded third-party endpoint (h77svwt7.instances.poc.jchunt.top). This occurs on every npm install without opt-in or any legitimate relationship to the upstream project it mimics. The package functions as a malicious beacon designed to fingerprint systems, representing a dependency confusion or typosquatting attack vector.
Potential Impact
The impact is the unauthorized collection and exfiltration of host metadata during package installation. This can lead to privacy violations and potential reconnaissance for further attacks. There is no indication of code execution beyond data collection or direct system compromise from the provided data.
Mitigation Recommendations
Users should avoid installing [email protected]. Remove the package if already installed. Use verified package sources and names to prevent typosquatting or dependency confusion attacks. Since no official fix or patch is indicated, the best mitigation is to not use this malicious package and rely on trusted upstream packages.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-14231
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a85b4c2acd9273b492524e3
Added to database: 08/19/2026, 13:50:58 UTC
Last enriched: 08/19/2026, 14:32:27 UTC
Last updated: 08/19/2026, 14:32:27 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.