🛡️ MAL-2026-10081 — webrix-docs1

Malicious code in webrix-docs1 (npm)

Source: amazon-inspector

The package declares a preinstall hook (node index.js) that fires automatically on npm install. The script requires child_process, os, https, and http, collects hostname, platform, arch, username/uid/gid, shell, home directory, CPU/memory stats, cwd, and the output of whoami/id, then POSTs the JSON payload to a hardcoded Burp Collaborator (oastify.com) subdomain at https://c7kfuaf25guwigaz6r03kxet0k6bu3is.oastify.com/detox56. The package has an empty description and empty author, presents no advertised functionality, and its name mimics the webrix project — consistent with dependency-confusion/typosquat recon. Installing the package directly leaks installer host and user identifiers to an attacker-controlled OAST endpoint.