MalwarePublished 27 Oct 2026Updated 29 Oct 2026

@webapp-shared/login-vmok (npm) · Malicious Code

Affects @webapp-shared/login-vmokSource GCVE Database

Malicious package : remove @webapp-shared/login-vmok and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 14:19 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-18356

What to do

Remove @webapp-shared/login-vmok from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@webapp-shared/login-vmok	Affected 1.0.0 – 99.0.1 6 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

@webapp-shared/login-vmok is a malicious npm package designed for dependency confusion attacks. It impersonates an internal scoped package and was published with multiple versions containing a postinstall script that sends sensitive host information to a remote server over unencrypted HTTP. The package also sends this data whenever it is loaded, disclosing internal hostnames and filesystem paths to an attacker-controlled endpoint. Placeholder versions without malicious code exist but are not affected.

Impact

Any system that installed an affected version of this package has disclosed internal hostnames and filesystem paths to an attacker-controlled server. This information leakage can facilitate targeted follow-on supply-chain attacks by revealing internal environment details. The package itself does not provide legitimate functionality and acts as a spying tool. There is no indication of further payload delivery or remote code execution from this package alone.

Defensive guidance

Remove all affected versions of @webapp-shared/login-vmok from your environment immediately. Pin or scope internal package names to your private registry to prevent dependency confusion attacks. Block network access to the IP address 13.140.137.222 on build and deployment hosts to prevent data exfiltration.

Summary

@webapp-shared/login-vmok is a dependency-confusion malicious package published under the @webapp-shared scope, mimicking a private internal package namespace. Versions 1.0.0, 1.0.1, 1.1.0, 2.0.1, 3.0.0, and 99.0.1 contain a postinstall script that executes beacon.cjs, which sends a JSON payload including the package name, the host's hostname, installation directory, current working directory, and Node.js version to a hardcoded IP address (http://13.140.137.222:8787/_ah/dc) over cleartext HTTP. The main entry point also sends this data on module load. The package exports a Proxy no-op to avoid errors and conceal its lack of legitimate functionality. This behavior leaks internal environment details to a third party, enabling potential targeted follow-on supply-chain attacks. Non-malicious placeholder versions 0.0.0-stage and 0.1.0 do not contain the beacon code or install scripts.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 14:19 UTC

Technical details

References

Community reviews