MAL-2026-19228: Malicious code in zxcvb90-utils-helper (npm)
--- -= Per source details. Do not edit below this line.=-
Source: amazon-inspector (37b270c23bd05f704fa06ea349aefd2d956af3fdcd3a851a5a7b89bc22493a12) index.js, the package main, issues a fetch to the hardcoded third-party collector https://webhook.site/ce5b0917-ae74-44c3-8a62-8a4e5003d44d with URL-encoded contents of document.documentElement.outerHTML (truncated to 4000 characters) appended as a query parameter. The call fires at require/import time in any environment where document and fetch exist (browser bundles, jsdom, Electron), silently exfiltrating page DOM — including any secrets, tokens, or user data rendered into the page — to an attacker-controlled webhook collector. The package has no declared purpose and an empty description. package.json additionally declares a self-dependency on zxcvb90-utils-helper with an unpinned pre-release range (^0.0.0-stage), so npm install resolves and installs whatever bytes the registry currently serves for that tag, with no integrity pin.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to the data exfiltration?
Applications that import or require the package in an environment where both document and fetch are available are exposed. The data specifically identifies browser bundles, jsdom, and Electron as affected environments.
When does the network request occur, and what can it send?
The request fires when the package is required or imported; no further function call is needed. It sends up to 4,000 characters of URL-encoded document.documentElement.outerHTML to the hardcoded webhook.site collector, which can include rendered secrets, tokens, and user data.
Is using the package in a typical server-side Node.js process described as affected?
The described behavior requires both document and fetch to exist. The provided data does not describe the request firing in a Node.js environment that lacks document.
What installation risk exists beyond the package's main code?
Its package.json declares a self-dependency using the unpinned pre-release range ^0.0.0-stage. According to the provided data, npm can resolve that dependency to whatever bytes the registry currently serves for that tag, without an integrity pin.