Supply chain · npm · High

Malicious npm package @wbnr/design identified, communicates with malicious domain

Threat Engine Auto-Feed · data current as of 2026-07-30

A critical severity malicious package, `@wbnr/design` version `99.3.0`, has been identified in the npm ecosystem. This package is known to communicate with a domain associated with malicious activity, posing a supply-chain risk to any project that installed it.

  • Package: npm / @wbnr/design
  • Affected versions: = 99.3.0
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Malicious package

The npm package `@wbnr/design` at version `99.3.0` was flagged as malicious by the OpenSSF Package Analysis project. The primary indicator of malicious activity is its communication with a domain known to be associated with malicious operations.

How the attack works

This is a malicious package attack, where a seemingly legitimate software component is designed to perform unauthorized actions. Upon installation and execution, the package initiates communication with an external, malicious domain, potentially exfiltrating data, downloading further payloads, or establishing command-and-control.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that pull unpinned or latest dependencies
  • Projects that have `@wbnr/design` version `99.3.0` as a direct or transitive dependency

Conditions that increase exposure

  • Unpinned dependency versions in `package.json` that allowed `99.3.0` to be installed
  • Lack of `package-lock.json` or `npm-shrinkwrap.json` to ensure deterministic builds
  • Internal package mirrors that do not vet upstream packages for malicious content

Blast-radius scenarios

  • An attacker could gain remote access or exfiltrate sensitive data from systems where the package is executed.
  • The malicious communication could lead to further compromise of development environments or production systems.
  • The blast radius includes any system that built or ran code incorporating this specific malicious package version.

What to do (defensive)

Detect

  • Scan `package-lock.json` or `npm-shrinkwrap.json` files for `@wbnr/design` at version `99.3.0`.
  • Review network logs for outbound connections to known malicious domains from development or build environments.
  • Utilize software composition analysis (SCA) tools to identify vulnerable or malicious dependencies.

Contain

  • Immediately quarantine any systems or environments found to have installed `@wbnr/design` version `99.3.0`.
  • Block network communication to the malicious domain identified by the package analysis.
  • Prevent further installations of `@wbnr/design` version `99.3.0` across all development and production environments.

Remediate

  • Remove `@wbnr/design` version `99.3.0` from all projects and rebuild applications with a clean dependency tree.
  • Rotate credentials and API keys that may have been exposed on compromised systems.
  • Implement strict dependency pinning and lockfile usage to ensure deterministic and secure builds.

Frontier verdict — High

Prioritize immediate detection and removal of `@wbnr/design` version `99.3.0` due to its critical severity and malicious network communication.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.