MalwarePublished 6 Aug 2026Updated 24 Sep 2026

@wbnr/frontend-shared (npm) · Malicious Code

Affects @wbnr/frontend-sharedSource GCVE Database

Malicious package : remove @wbnr/frontend-shared and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:15 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13436

What to do

Remove @wbnr/frontend-shared from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@wbnr/frontend-shared	Affected =99.0.0 =99.0.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @wbnr/frontend-shared versions 99.0.0 and 99.0.1 contains malicious code in its preinstall lifecycle script. This script collects the installer's OS username and hostname, then sends this information to a third-party callback domain via DNS lookup and HTTPS GET requests. This behavior aligns with a dependency-confusion probe, potentially exposing sensitive environment identifiers to an external attacker-controlled domain.

Impact

The malicious preinstall script leaks sensitive environment information such as the OS username and hostname to an external domain controlled by an attacker. This disclosure can aid attackers in reconnaissance and further targeted attacks. There is no indication of direct code execution or system compromise beyond information leakage. No known exploits in the wild have been reported.

Defensive guidance

Users should avoid installing versions 99.0.0 and 99.0.1 of @wbnr/frontend-shared. Consider auditing dependencies for malicious lifecycle scripts and use trusted package sources. Monitor for updates or advisories from the package maintainers or npm registry regarding this issue.

Summary

The @wbnr/frontend-shared npm package versions 99.0.0 and 99.0.1 include a preinstall.js script that executes automatically during npm install. This script reads environment variables for the OS username and uses the system hostname, embedding these values into a subdomain of a hardcoded callback domain (4otph6fase1x2won0hrfzul2wt2qqge5.oastify.com). It then transmits this data via DNS and HTTPS GET requests to the callback host under the /depconf/ path. This behavior is consistent with a dependency-confusion attack probe, leaking installer identifiers to a third-party infrastructure.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 7 Aug 2026, 07:17 UTC

Technical details

References

Community reviews