{"id":"MAL-2026-19228","kind":"package","aliases":["MAL-2026-19228"],"related":[],"title":"Malicious code in zxcvb90-utils-helper (npm)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (37b270c23bd05f704fa06ea349aefd2d956af3fdcd3a851a5a7b89bc22493a12)\nindex.js, the package main, issues a fetch to the hardcoded third-party collector https://webhook.site/ce5b0917-ae74-44c3-8a62-8a4e5003d44d with URL-encoded contents of document.documentElement.outerHTML (truncated to 4000 characters) appended as a query parameter. The call fires at require/import time in any environment where document and fetch exist (browser bundles, jsdom, Electron), silently exfiltrating page DOM — including any secrets, tokens, or user data rendered into the page — to an attacker-controlled webhook collector. The package has no declared purpose and an empty description. package.json additionally declares a self-dependency on zxcvb90-utils-helper with an unpinned pre-release range (^0.0.0-stage), so npm install resolves and installs whatever bytes the registry currently serves for that tag, with no integrity pin.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"zxcvb90-utils-helper","fixed":[],"affected":"= 1.0.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-13T03:58:46+00:00","first_seen_at":"2026-11-13T05:11:56+00:00","triaged_at":"2026-11-13T05:12:56+00:00","updated_at":"2026-11-13T05:14:00+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-19228':11A,14A '-2026':10A,13A '/ce5b0917-ae74-44c3-8a62-8a4e5003d44d':51C '0.0.0':137C '37b270c23bd05f704fa06ea349aefd2d956af3fdcd3a851a5a7b89bc22493a12':34C '4000':61C 'addit':119C 'amazon':32C 'amazon-inspector':31C 'append':63C 'attack':104C 'attacker-control':103C 'browser':82C 'bundl':83C 'byte':146C 'call':69C 'charact':62C 'code':2A 'collector':48C,107C 'content':56C 'control':105C 'current':149C 'data':96C 'declar':112C,120C 'depend':124C 'descript':117C 'detail':23C 'document':78C 'document.documentelement.outerhtml':58C 'dom':89C 'edit':26C 'electron':85C 'empti':116C 'encod':55C 'environ':76C 'exfiltr':87C 'exist':81C 'fetch':41C,80C 'fire':70C 'hardcod':44C 'helper':7A,18A,129C 'includ':90C 'index.js':35C 'inspector':33C 'instal':141C,144C 'integr':156C 'issu':39C 'jsdom':84C 'line':29C 'main':38C 'mal':9A,12A 'malici':1A,19B 'npm':8A,140C 'packag':20B,37C,109C 'package.json':118C 'page':88C,100C 'paramet':67C 'parti':47C 'per':21C 'pin':157C 'pre':134C 'pre-releas':133C 'purpos':113C 'queri':66C 'rang':136C 'registri':148C 'releas':135C 'render':97C 'require/import':72C 'resolv':142C 'secret':92C 'self':123C 'self-depend':122C 'serv':150C 'silent':86C 'sourc':22C,30C 'stage':138C 'tag':153C 'third':46C 'third-parti':45C 'time':73C 'token':93C 'truncat':59C 'unpin':132C 'url':54C 'url-encod':53C 'user':95C 'util':6A,128C 'utils':17A 'webhook':106C 'webhook.site':50C 'webhook.site/ce5b0917-ae74-44c3-8a62-8a4e5003d44d':49C 'whatev':145C 'zxcvb90':5A,16A,127C 'zxcvb90-utils-helper':4A,15A,126C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["zxcvb90utilshelper"],"ptokens":["helper","utils","zxcvb90"],"labels":["critical","malicious","npm","package"],"campaign_type":null,"search_a":"'-19228':11A,14A '-2026':10A,13A 'code':2A 'helper':7A,18A 'mal':9A,12A 'malici':1A 'npm':8A 'util':6A 'utils':17A 'zxcvb90':5A,16A 'zxcvb90-utils-helper':4A,15A","search_b":"'malici':19B 'packag':20B","search_c":"'/ce5b0917-ae74-44c3-8a62-8a4e5003d44d':51C '0.0.0':137C '37b270c23bd05f704fa06ea349aefd2d956af3fdcd3a851a5a7b89bc22493a12':34C '4000':61C 'addit':119C 'amazon':32C 'amazon-inspector':31C 'append':63C 'attack':104C 'attacker-control':103C 'browser':82C 'bundl':83C 'byte':146C 'call':69C 'charact':62C 'collector':48C,107C 'content':56C 'control':105C 'current':149C 'data':96C 'declar':112C,120C 'depend':124C 'descript':117C 'detail':23C 'document':78C 'document.documentelement.outerhtml':58C 'dom':89C 'edit':26C 'electron':85C 'empti':116C 'encod':55C 'environ':76C 'exfiltr':87C 'exist':81C 'fetch':41C,80C 'fire':70C 'hardcod':44C 'helper':129C 'includ':90C 'index.js':35C 'inspector':33C 'instal':141C,144C 'integr':156C 'issu':39C 'jsdom':84C 'line':29C 'main':38C 'npm':140C 'packag':37C,109C 'package.json':118C 'page':88C,100C 'paramet':67C 'parti':47C 'per':21C 'pin':157C 'pre':134C 'pre-releas':133C 'purpos':113C 'queri':66C 'rang':136C 'registri':148C 'releas':135C 'render':97C 'require/import':72C 'resolv':142C 'secret':92C 'self':123C 'self-depend':122C 'serv':150C 'silent':86C 'sourc':22C,30C 'stage':138C 'tag':153C 'third':46C 'third-parti':45C 'time':73C 'token':93C 'truncat':59C 'unpin':132C 'url':54C 'url-encod':53C 'user':95C 'util':128C 'webhook':106C 'webhook.site':50C 'webhook.site/ce5b0917-ae74-44c3-8a62-8a4e5003d44d':49C 'whatev':145C 'zxcvb90':127C 'zxcvb90-utils-helper':126C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T03:58:46+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-19228","url":"https://osv.dev/vulnerability/MAL-2026-19228","severity":"critical","published_at":"2026-11-13T03:58:46+00:00","modified_at":"2026-11-13T04:30:06+00:00","first_seen_at":"2026-11-13T05:11:56+00:00","fetched_at":"2026-11-13T05:11:56+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}