@woodpecker-web-shared/components

Details

**Severity:** Critical

**Affected versions:** `= 2.20.5`

## Source: amazon-inspector (5f5f21bcc5464689c5b7c70819eeca4ea481f76b5f7dac0358cfe2d967da235f)
On `npm install`, the package's postinstall hook runs `node index.js`, which collects installer host identifiers (os.hostname(), os.userInfo().username, os.platform(), architecture, cwd, node version, npm_lifecycle_event) and POSTs them as JSON to a hardcoded third-party collector at https://webhook.site/d9bc4bcc-ce74-4193-ae4e-96d234bb2220. The payload includes a `src: 'loMesb'` tag consistent with a campaign identifier used to correlate exfiltrated data across victims. The @woodpecker-web-shared/components scope/name has no legitimate reason to transmit installer identity to an anonymous webhook collector at install time, and the behavior fires automatically without user interaction. This is a recon beacon consistent with a dependency-confusion or typosquat lure.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/1b9f031b65c0c7f49c13fdbadbedf5b95af9ce9c/osv/malicious/npm/@woodpecker-web-shared/components/MAL-2026-16354.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/1b9f031b65c0c7f49c13fdbadbedf5b95af9ce9c/osv/malicious/npm/@woodpecker-web-shared/components/MAL-2026-16354.json
- https://www.npmjs.com/package/@woodpecker-web-shared/components/v/2.20.5
- https://github.com/ossf/malicious-packages/blob/fe02203d0609eeda37f2ae9f080d4b78c519bb7c/osv/malicious/npm/@woodpecker-web-shared/components/MAL-2026-16354.json
- https://www.npmjs.com/package/@woodpecker-web-shared/components/v/1.20.4
- https://www.npmjs.com/package/@woodpecker-web-shared/components/v/4.20.5
- https://github.com/advisories/GHSA-8hq6-gvg5-x8wq

Compromised versions (1)

• = 2.20.5

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.