@zaka13/thing

GHSA-m9vr-9hpp-v65x

Malicious code in @zaka13/thing (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

@zaka13/[email protected] ships the same disguised in-browser proxy kit as webpackbootstrap5 and webpackbootstrapscripts by the same publisher (zaka13). Its YXBp.js loader matches those packages' index-z2b7r4.js (same sha256): it XOR-decodes endpoints with a fixed key, injects remote scripts from https://dyingefforlessefforlessours.com, and boots a Scramjet/wisp WebSocket proxy routing traffic through operator relays. The package presents itself as 'thingy' with an SVG main entry. Harm is browser-side when the asset is served; no install script runs.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/bc49c4e0a6c92103a5859171f50ae5bc5d0f0eea/osv/malicious/npm/@zaka13/thing/MAL-2026-16200.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/bc49c4e0a6c92103a5859171f50ae5bc5d0f0eea/osv/malicious/npm/@zaka13/thing/MAL-2026-16200.json
- https://github.com/advisories/GHSA-m9vr-9hpp-v65x

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.