{"id":"MAL-2026-16221","revision":null,"records":[{"revision":"c697faeaeb2542cd8b337ce2ac2d0c5d","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-16221","aliases":[],"title":"Malicious code in bender-rspack-config (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3a6997cea54ae81d1addcb41ddac29e94923dfa1042265253c555cb4945ad5b4)\npackage.json declares a preinstall lifecycle script that runs `wget` against a hardcoded webhook.site URL, embedding `$(whoami)`, `$(pwd)`, and `$(hostname)` as query-string parameters. The request fires automatically on `npm install`, transmitting the installer's username, working-directory path, and hostname to an author-controlled collector at webhook.site/9d385aa8-875e-48b6-938c-6c0f5a0e8319/. The behavior is self-labeled as a dependency-confusion proof of concept, but the shipped code is a functioning identity-beacon regardless of framing.\n\n## Source: ossf-package-analysis (159730c04aeb50c0e832685be81c3f332d8692bf4a9f1a419c7223dbe5059491)\nThe OpenSSF Package Analysis project identified 'bender-rspack-config' @ 1.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n","state":0,"publishedAt":"2026-09-15T17:26:13+00:00","modifiedAt":"2026-09-17T14:30:05.3590445+00:00","affected":[{"ecosystem":"npm","name":"bender-rspack-config","ranges":[],"versions":["1.0.0"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/bender-rspack-config/v/1.0.0"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-16221","license":"OSV · upstream source license applies","key":"osv:MAL-2026-16221","identifiers":["MAL-2026-16221"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-13T08:11:31.6809232+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-13T08:11:31.6809232+00:00","lastSuccessAt":"2026-11-13T08:11:31.8454718+00:00","error":null,"lastVerifiedAt":"2026-11-13T08:11:31.8454723+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-d8fa82e95fdb59244e2f635e667ba17f0796ca0a4f1f4bb8cc31febcd660b76c-f9c14d66ebdc095f74fdcce47e61e279bf10bd494bc6489d0dbdffb6fc74976d","complete":true,"records":424979,"lastAttemptAt":"2026-11-13T08:09:37.3041052+00:00","lastSuccessAt":"2026-11-13T08:09:37.2686836+00:00","error":null,"lastVerifiedAt":"2026-11-13T08:09:37.3041052+00:00","snapshotPublishedAt":"2026-11-13T07:29:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-437fade2404f47a89844f2cbf9cdef00","complete":false,"records":13793,"lastAttemptAt":"2026-11-13T08:19:41.0909402+00:00","lastSuccessAt":"2026-11-13T08:19:41.1705931+00:00","error":null,"lastVerifiedAt":"2026-11-13T08:19:41.1705931+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-13T08:11:31.6809232+00:00","complete":true,"records":1123,"lastAttemptAt":"2026-11-13T08:11:31.6809232+00:00","lastSuccessAt":"2026-11-13T08:11:31.8468204+00:00","error":null,"lastVerifiedAt":"2026-11-13T08:11:31.8468207+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-2f453070477b44019a1e115c9cb19079","complete":true,"records":13793,"lastAttemptAt":"2026-11-13T08:11:55.1345588+00:00","lastSuccessAt":"2026-11-13T08:11:55.131+00:00","error":null,"lastVerifiedAt":"2026-11-13T08:11:55.131+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13846,"expectedIdentifiers":13846,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-93e76d404e1aeb6a7e8902f5ffa06211fc86dea3b1958e297abb2668aa5e6e8c","complete":true,"records":9952,"lastAttemptAt":"2026-11-13T08:11:31.5237746+00:00","lastSuccessAt":"2026-11-12T23:19:15.5239119+00:00","error":null,"lastVerifiedAt":"2026-11-13T08:11:31.5237746+00:00","snapshotPublishedAt":"2026-11-12T23:03:02+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-4d60731753a2f72e455d1086e7203d0ef10843936dcc1cf2b45135e2caa204b0","complete":true,"records":2012,"lastAttemptAt":"2026-11-13T08:09:37.3500635+00:00","lastSuccessAt":"2026-11-12T18:16:50.7862525+00:00","error":null,"lastVerifiedAt":"2026-11-13T08:09:37.3500635+00:00","snapshotPublishedAt":"2026-11-12T17:48:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-20d1a8ab073a1c13ab2143dbcadb34ebb8edf1e18e16482b448513662c3d1e12","complete":true,"records":3127,"lastAttemptAt":"2026-11-13T08:11:31.6298905+00:00","lastSuccessAt":"2026-11-12T22:18:31.0338213+00:00","error":null,"lastVerifiedAt":"2026-11-13T08:11:31.6298905+00:00","snapshotPublishedAt":"2026-11-12T22:18:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-9a5e7f9991d2e1e42f03c67106b36ec25ea027078c11453d28962165dbf82861","complete":true,"records":231769,"lastAttemptAt":"2026-11-13T08:11:31.3976856+00:00","lastSuccessAt":"2026-11-13T08:11:29.9974288+00:00","error":null,"lastVerifiedAt":"2026-11-13T08:11:31.3976856+00:00","snapshotPublishedAt":"2026-11-13T07:32:56+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}