wiasdcxc

GHSA-458c-rvqf-2638

Malicious code in wiasdcxc (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.1`

wiasdcxc is a dependency-confusion package (versions up to 99.0.1) from the same campaign as troubleshooting (MAL-2026-17641): a postinstall script runs beacon.cjs, which POSTs the installing host's name, install path and working directory to a hard-coded collector, and index.js, byte-identical to the troubleshooting payload (sha256 a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d), does the same when imported.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/23ba843b4a773277fa7a4a51240e83cd70ea2a45/osv/malicious/npm/wiasdcxc/MAL-2026-18698.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/23ba843b4a773277fa7a4a51240e83cd70ea2a45/osv/malicious/npm/wiasdcxc/MAL-2026-18698.json
- https://osv.dev/vulnerability/MAL-2026-17641
- https://www.npmjs.com/package/wiasdcxc
- https://github.com/advisories/GHSA-458c-rvqf-2638

Compromised versions (1)

= 1.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.