feed-widget-helper

GHSA-fgrp-3g95-g56v

Malicious code in feed-widget-helper (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (b5a81a96715497c25b18687ba7b9b42e919c23e700ede8d9944d41d6052d7f83)
The package's main entry executes a top-level side effect that reads document.cookie and sends it via fetch to a hardcoded webhook.site collector URL (http://webhook.site/67dba5f1-70f5-413e-9299-2ad886bb77fa) over plain HTTP. Any environment that imports or requires this package leaks its browser cookies to an anonymous third-party listener controlled by the package author. The destination is a webhook.site inbox — an anonymous request-capture service unrelated to any legitimate feed-widget functionality — and the transmission fires unconditionally on load, with no caller opt-in or configuration.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/af486be301974b4c4068b1c7baa77731f37fa05e/osv/malicious/npm/feed-widget-helper/MAL-2026-16332.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/af486be301974b4c4068b1c7baa77731f37fa05e/osv/malicious/npm/feed-widget-helper/MAL-2026-16332.json
- https://www.npmjs.com/package/feed-widget-helper/v/1.0.0
- https://github.com/advisories/GHSA-fgrp-3g95-g56v

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.