Note: This report is updated by a verification record
Malicious package due to data exfiltration via test, preinstall, and preupdate scripts in package.json using wget to send data to webhook.site.
The package is marked as malware by OSV: MAL-2026-2631 with source: ghsa-malware
Note: This report is updated by a verification record
The package is a malware because it contains suspicious scripts in package.json that exfiltrate sensitive information. The test, preinstall, and preupdate scripts all use wget to send the username, current path, and hostname to a remote server (webhook.site). This behavior is indicative of malicious intent.
