Malicious code in whs4_eud (npm)
The npm package 'whs4_eud' versions 1.0.0 and 1.0.1 contain malicious code that executes a postinstall script unconditionally upon installation. This script collects host information including the absolute install path (which reveals the user's home directory), Node.js version, and platform/architecture, then exfiltrates this data to a hardcoded Discord webhook URL. The webhook URL is lightly obfuscated by concatenating string literals at runtime. The package appears to function as a dependency-confusion or typosquatting beacon, notifying the author when an install occurs and disclosing the installation environment.
AI Analysis
Technical Summary
The 'whs4_eud' npm package versions 1.0.0 and 1.0.1 include a postinstall lifecycle script that runs automatically on 'npm install'. This script sends sensitive host environment details to a Discord webhook URL assembled at runtime, indicating malicious intent to collect installation telemetry. The package's naming and behavior align with dependency confusion or typosquatting tactics, serving primarily as a beacon to inform the attacker of installation events and environment details. The OpenSSF Package Analysis project flagged this package as malicious due to its communication with a domain linked to malicious activity.
Potential Impact
Installation of the affected 'whs4_eud' package versions results in unintended disclosure of host environment information to an attacker-controlled Discord webhook. This includes the absolute installation path (which may reveal user home directory structure), Node.js version, and platform details. While no direct code execution beyond the postinstall script is indicated, this data leakage can aid attackers in profiling victims or preparing further targeted attacks.
Mitigation Recommendations
No official patch or remediation is currently documented. Users and organizations should avoid installing the 'whs4_eud' package versions 1.0.0 and 1.0.1. Review and remove these packages from existing projects if present. Monitor package dependencies for typosquatting or dependency confusion risks. Since this is a malicious package, no legitimate use is recommended. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.
Malicious code in whs4_eud (npm)
Description
The npm package 'whs4_eud' versions 1.0.0 and 1.0.1 contain malicious code that executes a postinstall script unconditionally upon installation. This script collects host information including the absolute install path (which reveals the user's home directory), Node.js version, and platform/architecture, then exfiltrates this data to a hardcoded Discord webhook URL. The webhook URL is lightly obfuscated by concatenating string literals at runtime. The package appears to function as a dependency-confusion or typosquatting beacon, notifying the author when an install occurs and disclosing the installation environment.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'whs4_eud' npm package versions 1.0.0 and 1.0.1 include a postinstall lifecycle script that runs automatically on 'npm install'. This script sends sensitive host environment details to a Discord webhook URL assembled at runtime, indicating malicious intent to collect installation telemetry. The package's naming and behavior align with dependency confusion or typosquatting tactics, serving primarily as a beacon to inform the attacker of installation events and environment details. The OpenSSF Package Analysis project flagged this package as malicious due to its communication with a domain linked to malicious activity.
Potential Impact
Installation of the affected 'whs4_eud' package versions results in unintended disclosure of host environment information to an attacker-controlled Discord webhook. This includes the absolute installation path (which may reveal user home directory structure), Node.js version, and platform details. While no direct code execution beyond the postinstall script is indicated, this data leakage can aid attackers in profiling victims or preparing further targeted attacks.
Mitigation Recommendations
No official patch or remediation is currently documented. Users and organizations should avoid installing the 'whs4_eud' package versions 1.0.0 and 1.0.1. Review and remove these packages from existing projects if present. Monitor package dependencies for typosquatting or dependency confusion risks. Since this is a malicious package, no legitimate use is recommended. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-11071
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a7b6fbcbf8831d5393e7b08
Added to database: 08/11/2026, 18:53:48 UTC
Last enriched: 08/11/2026, 18:55:54 UTC
Last updated: 08/11/2026, 18:55:54 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.