wxwxtt

GHSA-678p-cx2w-w69p

Malicious code in wxwxtt (npm)

Details

**Severity:** Critical

**Affected versions:** `= 0.0.0`

wxwxtt is a dependency-confusion package (versions up to 99.0.1) from the same campaign as troubleshooting (MAL-2026-17641): a postinstall script runs beacon.cjs, which POSTs the installing host's name, install path and working directory to a hard-coded collector, and index.js, byte-identical to the troubleshooting payload (sha256 a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d), does the same when imported.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/23ba843b4a773277fa7a4a51240e83cd70ea2a45/osv/malicious/npm/wxwxtt/MAL-2026-18701.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/23ba843b4a773277fa7a4a51240e83cd70ea2a45/osv/malicious/npm/wxwxtt/MAL-2026-18701.json
- https://osv.dev/vulnerability/MAL-2026-17641
- https://www.npmjs.com/package/wxwxtt
- https://github.com/advisories/GHSA-678p-cx2w-w69p

Compromised versions (1)

= 0.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.