@corpweb-ui/wmkt-library

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (dfd12ddf708e12b032513bcf667e459df772f642106507d1798d95ee81f6cbe2)
index.js uses child_process to execute `whoami` and gather `hostname` information, then transmits results via https.get to api.telegram.org/bot — a well-known pattern for Telegram-bot-based C2/exfiltration. The package name mimics a corporate UI library but the code performs system reconnaissance and exfiltration of installer host data, with no legitimate UI-library functionality indicated at the entry point. Any installer or build system that pulls this package will leak the machine's user and hostname to an attacker-controlled Telegram bot on require/load. Three independent static detections (child-process + https exfiltration, nodejs system exfiltration, simple sysinfo exfiltration) corroborate a single small file implementing a classic recon beacon.

## Source: ossf-package-analysis (e04e7522e73249638f1fd02bc8b13369626291222da0a2ba1612bbcba6a14bad)
The OpenSSF Package Analysis project identified '@corpweb-ui/wmkt-library' @ 99.99.11 (npm) as malicious.

It is considered malicious because:

- The package communicates with a domain associated with malicious activity.

Compromised versions (2)

• 99.99.11
• 99.99.12

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.