MAL-2026-13948
Malicious code in debug-proxy-chrome-devtools (npm)
상세
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (b7a0986932a47f49b162ea0438acfd0b6293e027e8ac2da46eb1221c5d52646c) debug-proxy-chrome-devtools@1.0.1 declares a postinstall hook (`"postinstall": "node install.js"`) that automatically executes on `npm install`. install.js uses `child_process.execSync` to run `whoami` on the installer's machine and then issues an `https.get` to a hardcoded webhook.site collector (`https://webhook.site/cfe35ac2-bec3-48b8-bae1-a49dea5412c2`), passing the captured command output and hostname/command identifiers as URL query parameters. The package advertises itself as a Chrome DevTools debug proxy; that stated purpose has no need for shell reconnaissance or beaconing to a third-party request-inspection service. The combination of automatic install-time execution, capture of installer-side identity data, and a hardcoded non-first-party exfiltration endpoint matches the reconnaissance/beacon shape of a malicious postinstall payload.
이 버전이 영향받나요?
사용 중인 패키지 버전을 입력하면 즉시 평가합니다.
영향 패키지
No fixed version published yet for debug-proxy-chrome-devtools (npm). Pin to a known-safe version or switch to an alternative.