Malicious code in debug-proxy-chrome-devtools (npm)
debug-proxy-chrome-devtools@1.0.1 on npm contains malicious postinstall code that executes automatically during installation, capturing the installer's username and hostname and exfiltrating them to a third-party webhook service.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed debug-proxy-chrome-devtools@1.0.1
- Ecosystems
- Attack vectors
- Affected entities
- debug-proxy-chrome-devtools · 1.0.1
The npm package debug-proxy-chrome-devtools@1.0.1 contains a postinstall hook that automatically executes when the package is installed. The hook runs install.js, which uses child_process.execSync to execute the whoami command on the installer's machine and capture the output.\n\nThe captured identity data (username and hostname) is then exfiltrated via an HTTPS GET request to a hardcoded webhook.site endpoint (https://webhook.site/cfe35ac2-bec3-48b8-bae1-a49dea5412c2), with the data passed as URL query parameters. This behavior is inconsistent with the package's stated purpose as a Chrome DevTools debug proxy, which has no legitimate need for shell reconnaissance or beaconing to third-party services.\n\nThe combination of automatic install-time execution, capture of installer identity information, and exfiltration to a non-first-party endpoint is characteristic of a reconnaissance and beaconing payload. The incident was identified by the OpenSSF malicious packages project.
Indicators of compromise
- Packages
- debug-proxy-chrome-devtools@1.0.1
- Domains
- webhook.site
Remediation
- Immediately uninstall debug-proxy-chrome-devtools@1.0.1 from all systems
- Audit npm install logs to identify which systems may have installed this package
- Review network logs for connections to webhook.site from affected systems
- Consider the username and hostname captured by the malicious payload as potentially compromised
- Use npm audit to check for this package in dependency trees
- If the package was a direct or transitive dependency, identify and update to a safe alternative or remove the dependency
Sources
- GitHub Advisory GHSA-6f7w-v259-jq39 · GitHub Advisory Database
Cite this entry
"Malicious code in debug-proxy-chrome-devtools (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 13, 2026; last updated August 13, 2026. https://supplychainattack.org/incident/malicious-code-in-debug-proxy-chrome-devtools-npm-5iv1c4
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in @syncraft-labs/vue (npm)
The npm package @syncraft-labs/vue version 0.4.1 contained malicious obfuscated code in its ESM build that implements a blockchain-hosted C2 dropper (EtherHiding pattern), enabling remote code execution on any consumer importing the package.
npmCompromised package - resolvedcritical
Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)
Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.
npmDependency confusionCompromised package - activecritical
Malware in @sdgdfgdfhhhfd/multiviewr
Malware discovered in the npm package @sdgdfgdfhhhfd/multiviewr. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malicious code in 3-buildsight-web (npm)
The npm package 3-buildsight-web contains malicious code that fetches and executes arbitrary JavaScript from a remote Bitbucket URL on module load, granting full page privileges to an unverified third party.
npmCompromised package