Malicious code in webautomation_js (npm)
The npm package webautomation_js contained malicious code that exfiltrates caller-supplied arguments to an attacker-controlled endpoint. The package used obfuscation and RC4 encryption to hide the destination URL and axios module name from inspection.
- Disclosed
- Last updated
- Blast radius
- Any application using the webautomation_js package would send caller-supplied arguments to an attacker-controlled endpoint.
- Ecosystems
- Attack vectors
- Affected entities
- webautomation_jsnpm package with malicious code
The npm package webautomation_js was found to contain malicious code designed to exfiltrate data to an attacker-controlled server. The package's index.js file was obfuscated using obfuscator.io with RC4 string-array encryption and a self-defending debugger-check wrapper.\n\nThe only exported function appends a caller-supplied argument to a hardcoded API_BASE_URL and issues an HTTP request via axios. Both the axios module name and all URL fragments are reconstructed at runtime from the RC4-encoded string array, making the destination invisible in normal source code inspection. The package description ("logger tool for validation entry"), README, and empty author metadata provided no disclosure of this hidden endpoint.\n\nThe documented purpose of the package does not require a remote endpoint, and legitimate HTTP client libraries do not RC4-encrypt their endpoint strings. Any application invoking the exported function would unknowingly send data to the attacker-controlled destination.\n\nThe incident was identified by the OpenSSF malicious-packages project and reported via GitHub Security Advisory GHSA-v4hj-5v4c-hpx9.
Indicators of compromise
- Packages
- webautomation_js
Remediation
- Remove the webautomation_js package from all projects immediately
- Audit application logs and network traffic for any data sent to unknown endpoints while the package was installed
- Review any data that may have been exfiltrated through the package's exported function
- Use npm audit to identify all affected dependencies
- Replace webautomation_js with a legitimate, well-maintained alternative if the functionality is needed
Sources
- GitHub Advisory GHSA-v4hj-5v4c-hpx9 · GitHub Advisory Database
Cite this entry
"Malicious code in webautomation_js (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 14, 2026; last updated August 14, 2026. https://supplychainattack.org/incident/malicious-code-in-webautomation-js-npm-1rczx9
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in sui-move-graphql
Malware was discovered in the npm package sui-move-graphql. Systems with this package installed or running should be considered fully compromised, requiring immediate rotation of all secrets and keys from a different computer.
npmCompromised package - containedcritical
Malicious code in runtime-health (npm)
The npm package runtime-health version 1.0.2 was identified as malicious by the OpenSSF Package Analysis project. The package executes commands associated with malicious behavior.
npmCompromised package - containedcritical
Malware in blastradar
Malware was discovered in the npm package blastradar, resulting in full system compromise for any computer with the package installed or running. All secrets and keys on affected systems should be rotated immediately from a different computer.
npmCompromised package - resolvedcritical
Malicious code in bcc-design (npm)
bcc-design@9999.0.0 on npm is a dependency-confusion beacon package with no legitimate functionality. Its postinstall script exfiltrates the installer's hostname and system metadata to an attacker-controlled IP endpoint.
npmDependency confusionCompromised package