webrix-docs (npm) · Malicious Code
Affects webrix-docsSource GCVE Database
Malicious package : remove webrix-docs and rotate any secrets on hosts that installed it.
Data as of 10 Jul 2026, 10:17 UTC
Malicious package
Published to npm · OSV MAL-2026-10080
What to do
Remove webrix-docs from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmwebrix-docs | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package 'webrix-docs' version 20.2.11 contains malicious code that executes automatically during installation. It runs a script that collects host system information such as hostname, user details, platform, current directory, and command outputs, then sends this data to a remote server. The package appears to be a typosquatting attempt mimicking a legitimate library, with no legitimate code and an empty author field.