ZXCVB90-UTILS-HELPER · MAL-2026-19228 · Package
UNINSTALL IT, ROTATE THE KEYS IT COULD READ
Not triaged yet. The sources’ own description is below.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Unknown from the sources.
Unknown from the sources.
-= Per source details. Do not edit below this line.=-
index.js, the package main, issues a fetch to the hardcoded third-party collector https://webhook.site/ce5b0917-ae74-44c3-8a62-8a4e5003d44d with URL-encoded contents of document.documentElement.outerHTML (truncated to 4000 characters) appended as a query parameter. The call fires at require/import time in any environment where document and fetch exist (browser bundles, jsdom, Electron), silently exfiltrating page DOM — including any secrets, tokens, or user data rendered into the page — to an attacker-controlled webhook collector. The package has no declared purpose and an empty description. package.json additionally declares a self-dependency on zxcvb90-utils-helper with an unpinned pre-release range (^0.0.0-stage), so npm install resolves and installs whatever bytes the registry currently serves for that tag, with no integrity pin.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.