webpackbootstrap5

GHSA-wvx4-99w4-gwvh

Malicious code in webpackbootstrap5 (npm)

Details

**Severity:** Critical

**Affected versions:** `= 5.0.0`

[email protected] typosquats bootstrap and ships a disguised in-browser proxy kit. Its bundled loader (index-z2b7r4.js) XOR-decodes a list of endpoints with a fixed key and injects remote scripts from https://dyingefforlessefforlessours.com via document.head.appendChild, then boots a Scramjet/wisp WebSocket proxy that routes page traffic through operator-controlled relays. The loader matches (same sha256) sibling packages webpackbootstrapscripts and @zaka13/thing by the same publisher (zaka13). Harm is browser-side when the asset is served; no install script runs.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/bc49c4e0a6c92103a5859171f50ae5bc5d0f0eea/osv/malicious/npm/webpackbootstrap5/MAL-2026-16201.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/bc49c4e0a6c92103a5859171f50ae5bc5d0f0eea/osv/malicious/npm/webpackbootstrap5/MAL-2026-16201.json
- https://github.com/advisories/GHSA-wvx4-99w4-gwvh

Compromised versions (1)

= 5.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.