🛡️ MAL-2026-5541 — web-components

Malicious code in @w2d/web-components (npm)

Source: amazon-inspector

The package targets the @w2d scope with an artificially high version (2.999.999) — the canonical dependency-confusion shape designed to outrank an internal registry's real package. On npm install, postinstall.js collects host identity (os.hostname(), os.userInfo(), process.cwd(), process.platform), base64-encodes the payload, and exfiltrates it to a hardcoded Burp Collaborator OAST domain 929u6o01dc28rl4mend089t9b0hr5ht6.oastify.com over both HTTPS GET (postinstall.js:28) and DNS lookup (postinstall.js:31). Comments in the file self-describe the package as a dependency-confusion PoC against Allwyn AG / win2day. Regardless of the author's stated bug-bounty framing, any installer whose registry configuration resolves the public @w2d/web-components instead of the intended internal package will silently beacon host/user/cwd identifiers to the attacker-controlled OAST host on install.