Malicious code in specials-obid-webpack (npm)
The npm package specials-obid-webpack contained malicious code that executed arbitrary binaries downloaded from attacker-controlled Cloudflare Workers hosts upon installation or require. The package used obfuscation techniques including string splitting, DNS-based covert channels, and disguised file paths to evade detection.
- Disclosed
- Last updated
- Blast radius
- Any system that installed or required the specials-obid-webpack package
- Ecosystems
- Attack vectors
- Affected entities
- specials-obid-webpackMalicious npm package containing remote code execution payload
The npm package specials-obid-webpack was found to contain malicious code that triggered remote code execution on any system where the package was installed or required. Upon package load, the _vendor.js module selected a platform-specific URL, downloaded a binary from attacker-controlled Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev), and executed it with elevated permissions.
The malware employed multiple obfuscation and evasion techniques to avoid detection. Destination hostnames were assembled at runtime using array .join("") operations, filenames were disguised to impersonate legitimate diagnostic tools (/tmp/.cache_ on Unix, %TEMP%\dotnet_diag_.exe on Windows), and code identifiers were split (e.g., "child_"+"process", "chmod"+"Sync") to evade static analysis.
A secondary dropper implementation was bundled in lib/telemetry.js using DNS-TXT covert channels to reassemble base64-encoded payloads from *.dl.well1.site. The package was identified by the OpenSSF malicious-packages project and credited to Amazon Inspector.
Indicators of compromise
- Packages
- specials-obid-webpack
- Domains
- oob-worker.cf99-9b3.workers.dev
- oob-worker.cf100-416.workers.dev
- oob-worker.cf101-adf.workers.dev
- oob-worker.cf103-070.workers.dev
- dl.well1.site
Remediation
- Immediately uninstall specials-obid-webpack from all systems
- Audit npm package.lock and yarn.lock files for any presence of specials-obid-webpack
- Review system logs and process execution history on any machine that installed or required this package for signs of unauthorized binary execution
- Block outbound connections to oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, and *.dl.well1.site at the network level
- Consider any system that installed this package as potentially compromised and perform forensic analysis
- Update npm security policies to flag and block this package
Sources
- GitHub Advisory GHSA-3g4w-f3vp-2cjp · GitHub Advisory Database
Cite this entry
"Malicious code in specials-obid-webpack (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-specials-obid-webpack-npm-euxa8e
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in santana-baileys (npm)
Malicious code discovered in santana-baileys npm package that covertly relays WhatsApp messaging data to an attacker-controlled endpoint (https://fiora.nixel.my.id/) via obfuscated character-code reconstruction in the message-send code path.
npmCompromised package - resolvedcritical
Malicious code in elephant-tusk-runner (npm)
The npm package elephant-tusk-runner contained malicious code that exposed a remote shell and remote code execution surface via an unauthenticated Express + WebSocket server binding to 0.0.0.0:4201 with fully open CORS. Any peer able to reach the port could execute arbitrary commands on the host.
npmCompromised package - resolvedcritical
Malicious code in @cats-cdf/browser-metrics-meter (npm)
The npm package @cats-cdf/browser-metrics-meter contained malicious code in its preinstall lifecycle script that exfiltrated system reconnaissance data (username, hostname, public IP) to an OAST collector domain. The package executed this behavior unconditionally on installation without consent or documented purpose.
npmCompromised package - resolvedcritical
Malicious code in @ks-video/kwai-player-web (npm)
The npm package @ks-video/kwai-player-web contained malicious code in its postinstall hook that exfiltrated system reconnaissance data (hostname, username, working directory, network interfaces, environment variable names) over plain HTTP to an unrelated third-party domain. The package has no legitimate relationship to the declared publisher Kwai/@ks-video.
npmCompromised package