confx1789550882

GHSA-x9hr-wrvh-643j

Malicious code in confx1789550882 (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (72ce9bca41cb0378952b582d6f115a3bffd2acea4999a90bae5f916428921b64)
The package's main file index.js is an IIFE that, when loaded in a browser same-origin context (e.g. via unpkg), reads location.href and document.cookie, fetches authenticated endpoints such as /profile, /admin, /dev, /flag, and /me with credentials:'include', and POSTs the responses along with a matched flag pattern to the hardcoded webhook https://webhook.site/04d98207-c947-4938-9f0c-f92feae051cb/. package.json contains only a 'ctf' description with no author or repository, and the single shipped artifact is this exfiltration payload. Comments in the file describe it as an unpkg-hosted exfil payload.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/7cfd15c0a0837e774677cae74f0a80427bead5db/osv/malicious/npm/confx1789550882/MAL-2026-16260.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/7cfd15c0a0837e774677cae74f0a80427bead5db/osv/malicious/npm/confx1789550882/MAL-2026-16260.json
- https://www.npmjs.com/package/confx1789550882/v/1.0.0
- https://github.com/advisories/GHSA-x9hr-wrvh-643j

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.