MAL-2026-14353
Malicious code in @gfe/lx-watcher (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (22abe9bf1ccb266833585bda205a07bc5c9a728763a733aa48b08fe50b640b4e) All three npm lifecycle hooks (preinstall, install, postinstall) invoke install.js, which POSTs the installer's hostname, OS username, current working directory, timestamp, and hook name to a hardcoded webhook.site collector at https://webhook.site/df384ffa-1094-4bbf-a202-e8b345b3ed18/gfe. The exfiltration fires automatically on `npm install` with no caller consent and no configuration. The package's `main` is a no-op `createWatcher` stub, so a build that resolves this scoped name silently succeeds while host identifiers are leaked. The scoped `@gfe/*` name combined with the no-op stub and the install-time beacon is the canonical dependency-confusion shape: any organization whose private `@gfe/lx-watcher` resolves against the public registry leaks host, username, and install-path metadata to the author-controlled collector.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for @gfe/lx-watcher (npm). Pin to a known-safe version or switch to an alternative.