🛡️ MAL-2026-12327 — offa-uwk

Malicious code in @offa-uwk/offa-uwk (npm)

Source: amazon-inspector

On npm install, the package's postinstall script (node index.js) collects host identifiers (os.hostname(), os.userInfo().username, process.cwd()) and POSTs them via HTTPS to a hardcoded webhook.site collector at https://webhook.site/e6b10849-38dc-4280-a8e3-72ab39cfaf65. Immediately after the beacon, the script executes shutdown -h now with a fallback of systemctl poweroff, forcibly powering off the installing host. A preinstall step also writes a marker file to the absolute path /home/OFFA/flag, outside the package directory. Package metadata (name @offa-uwk/offa-uwk, version 999.0.6) is consistent with a proof-of-concept malicious artifact.