MalwarePublished 9 Jun 2026Updated 20 Jul 2026

@webd-infra/query-designer-domain (npm) · Malicious Code

Affects @webd-infra/query-designer-domainSource GCVE Database

Malicious package : remove @webd-infra/query-designer-domain and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 15:55 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-5431

What to do

Remove @webd-infra/query-designer-domain from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@webd-infra/query-designer-domain	Affected =99.9.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @webd-infra/query-designer-domain version 99.9.1 is identified as malicious. It declares a dependency on an off-registry tarball hosted on a Google Cloud Storage bucket, allowing the bucket owner to execute arbitrary code during installation. The package itself contains no runtime code other than resolving and executing this external tarball. Installation of this package can lead to full system compromise, requiring immediate secret and key rotation and package removal.

Impact

Systems with this package installed are fully compromised, as the malicious tarball can execute arbitrary code with the privileges of the installing user. All secrets and keys on the compromised system are at risk and must be rotated. Removal of the package alone may not eliminate all malicious software introduced during installation.

Defensive guidance

Remove the @webd-infra/query-designer-domain package version 99.9.1 immediately. Rotate all secrets and keys from a separate, uncompromised system. Because full system compromise is likely, assume persistent malicious presence and perform a thorough incident response.

Summary

The @webd-infra/query-designer-domain package at version 99.9.1 is a malicious npm package that uses a direct tarball URL dependency to an untrusted Google Cloud Storage bucket. This setup bypasses npm registry controls, enabling execution of arbitrary lifecycle scripts from the tarball, which can be changed at any time by the bucket owner. The package has no legitimate runtime code and serves solely to execute this off-registry code. Due to this behavior, any system with this package installed should be considered fully compromised.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Jun 2026, 22:19 UTC

Technical details

References

Community reviews