npm · Malicious package advisory
Malwareudn_extras
MAL-2025-6387
Malicious code in udn_extras (npm)
Details
The package is a malware because it contains a postinstall script that executes index.js. The index.js script gathers sensitive information such as hostname, platform, username, IP address, and environment variables and sends it to an external server (webhook.site) via an HTTPS POST request. This constitutes data exfiltration and is a clear indicator of malicious behavior. --- _-= Per source details. Do not edit below this line.=-_
Compromised versions (2)
- 1.0.0
- 9999.0.0
Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.