wos-library-ui

GHSA-j5rq-m53m-6xfx

Malicious code in wos-library-ui (npm)

Details

**Severity:** Critical

**Affected versions:** `= 99.0.0`

## Source: amazon-inspector (3124274f6fcb74cf0805b5545f6952214b90329427f55c616c868f760d592e63)
[email protected] declares scripts.preinstall = 'node poc.js', which auto-runs on npm install. poc.js reads os.hostname(), os.userInfo().username, and process.cwd() and transmits them to the hardcoded Interactsh subdomain csytkgaubytabdgcvgljmgf8o1uj876pg.oast.fun via both a DNS A-record lookup (encoding host/user in the subdomain) and an http.request POST. The package name and inflated 99.0.0 version match the classic dependency-confusion shape targeting an internal 'wos-library-ui' package (self-described as an Inditex WOS PoC): any resolver that prefers the public npm registry will pull this artifact instead of the internal one and execute the beacon, disclosing internal host identifiers and build-path details to a third-party out-of-band collector. Self-labeling as a bug-bounty PoC does not alter the installer-side effect: unconsented install-time exfiltration of installer identity from a namesquatted package on the public registry.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/c34770d899b0c88f6643ca0850c10d12436518c4/osv/malicious/npm/wos-library-ui/MAL-2026-13467.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/c34770d899b0c88f6643ca0850c10d12436518c4/osv/malicious/npm/wos-library-ui/MAL-2026-13467.json
- https://www.npmjs.com/package/wos-library-ui/v/99.0.0
- https://github.com/advisories/GHSA-j5rq-m53m-6xfx

Compromised versions (1)

= 99.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.