Malicious code in wct-st (npm)
The npm package wct-st contained malicious code in its postinstall lifecycle script that collected and exfiltrated host identifiers to a remote endpoint. The package name resembles the deprecated web-component-tester, consistent with a typosquatting attack.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed wct-st
- Ecosystems
- Attack vectors
- Affected entities
- wct-stnpm package with malicious postinstall script
The npm package wct-st was found to contain malicious code that executed during package installation. Upon npm install, the postinstall lifecycle script automatically collected host identifiers including hostname, platform, architecture, Node.js version, package name, and npm lifecycle event.
This collected data was POSTed as JSON to a hardcoded remote endpoint at https://bhvte4h4.instances.poc.jchunt.top/wct-st without any user consent, configuration option, or opt-out mechanism. The beacon fired automatically upon installation.
The package name closely resembles the deprecated web-component-tester package, indicating this was likely a typosquatting or dependency-confusion attack designed to capture information from developers installing what they believed to be a legitimate package.
The incident was identified and credited to the OpenSSF's malicious-packages repository.
Indicators of compromise
- Packages
- wct-st
- Domains
- bhvte4h4.instances.poc.jchunt.top
Remediation
- Remove wct-st from all npm installations immediately
- Audit npm package.json files and lock files for any references to wct-st
- Review host identifiers and network logs for any suspicious outbound connections to bhvte4h4.instances.poc.jchunt.top
- Use legitimate package names and verify package authenticity before installation
- Consider using npm audit and supply chain security tools to detect similar malicious packages
Sources
- GitHub Advisory GHSA-6r3v-5c9p-jv7v · GitHub Advisory Database
Cite this entry
"Malicious code in wct-st (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 14, 2026; last updated August 14, 2026. https://supplychainattack.org/incident/malicious-code-in-wct-st-npm-1y2pys
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in lodsh-cli (npm)
lodsh-cli, a typosquat of lodash-cli on npm, contained malicious code in its postinstall script that executed arbitrary remote code and exfiltrated system information. The package downloaded a Windows executable and sent platform data to a hardcoded IP address.
npmTyposquattingCompromised package - containedcritical
Malicious code in lodahsjs (npm)
The npm package lodahsjs is a typosquatting attack on 'lodash' that contains malicious code in its postinstall script. Upon installation, it exfiltrates system information to a C2 server and downloads and executes a Windows binary, with capability to bridge WSL environments to compromise the host Windows system.
npmCompromised packageTyposquatting - containedcritical
Malicious code in loadashjs (npm)
loadashjs is a typosquat package on npm containing malicious postinstall code that exfiltrates system information and downloads a Windows PE binary from a hardcoded GitHub release URL. The package masquerades as lodash but provides no legitimate functionality.
npmTyposquattingCompromised package - containedcritical
Malicious code in chalk-core (npm)
chalk-core@1.0.0 is a typosquatting package masquerading as the popular chalk library. It contains malicious postinstall scripts that decode and execute arbitrary binaries on Windows and WSL systems, with command-and-control beaconing to 193.70.34.101:20099.
npmTyposquattingCompromised package