web-main

GHSA-mq47-gfmg-59pp

Malicious code in web-main (npm)

Details

**Severity:** Critical

**Affected versions:** `= 22.1.2`

## Source: amazon-inspector (61680a5d53758bc9eb99b1cd2566e6e19139d09fee10a0096a5e72bb0953a5b2)
package.json declares `preinstall: node index.js`, causing index.js to execute automatically on `npm install`. The script collects os.hostname(), os.userInfo() (username/uid/gid/shell), platform, arch, homedir, and the stdout of `whoami`, `id`, and `pwd` via child_process.exec, then POSTs the aggregated JSON to a hardcoded endpoint at https://smi54v4uvb9q7ve5t6fnyro16scj0co1.oastify.com/system-info (a Burp Collaborator out-of-band host). No legitimate functionality is present; the package's sole effect on install is host reconnaissance and exfiltration to an attacker-controlled OOB collector.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/c84d6ff0e4a864f0926f41430c4478a4c99e4108/osv/malicious/npm/web-main/MAL-2026-16153.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/c84d6ff0e4a864f0926f41430c4478a4c99e4108/osv/malicious/npm/web-main/MAL-2026-16153.json
- https://www.npmjs.com/package/web-main/v/22.1.2
- https://github.com/advisories/GHSA-mq47-gfmg-59pp

Compromised versions (1)

= 22.1.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.