MAL-2026-12815
Malicious code in widget-forge (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (5dc77fe941595018023e8382eac28ffdf8d1b000217a0e4d01e56e7bb48ac2d8) widget-forge@9999.0.0 is a dependency-confusion beacon. package.json declares scripts.preinstall = 'node callback.js', which auto-runs on npm install. callback.js collects os.hostname(), os.userInfo().username, process.cwd(), npm_config_registry, and CI repository identifiers (GITHUB_REPOSITORY and related CI env vars) and sends them via HTTP GET to the hardcoded bare-IP endpoint http://75.119.137.232:31337/depconfuse?pkg=.... The package has no functional payload: main is an empty object export, the description is a generic placeholder, and the version 9999.0.0 is the pattern used to outbid internal package versions in dependency-confusion attacks. The only effect of installation is the recon callback to the hardcoded IP.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for widget-forge (npm). Pin to a known-safe version or switch to an alternative.