Supply chain · npm · High

Malicious npm package @woodpecker-web-shared/components exfiltrates host data

Threat Engine Auto-Feed · data current as of 2026-09-21

A malicious version of the npm package `@woodpecker-web-shared/components` (v2.20.5) has been identified. This package automatically collects and exfiltrates host identifiers upon installation, posing a significant supply-chain risk for npm users.

  • Package: npm / @woodpecker-web-shared/components
  • Affected versions: = 2.20.5
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Typosquatting

The npm package `@woodpecker-web-shared/components` version 2.20.5 contains malicious code. Upon `npm install`, a postinstall hook executes `node index.js`, which gathers host identifiers such as hostname, username, platform, architecture, current working directory, Node.js version, and npm lifecycle event. This collected data is then transmitted as JSON to a hardcoded third-party collector at `https://webhook.site/d9bc4bcc-ce74-4193-ae4e-96d234bb2220`.

How the attack works

This is a typosquatting attack where a malicious package mimics a legitimate one. The attack leverages an automated script that runs during the package installation process. This script performs reconnaissance by collecting system information and sending it to an external server, without requiring any user interaction beyond the initial package installation.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • CI/CD pipelines that pull npm packages, especially if configured to fetch the latest versions or unpinned dependencies
  • Organizations with internal package mirrors that may have ingested the malicious version

Conditions that increase exposure

  • Projects with unpinned dependencies that could resolve to the malicious version 2.20.5 of `@woodpecker-web-shared/components`
  • Lack of `package-lock.json` or equivalent lockfiles to ensure deterministic dependency resolution
  • Use of internal package mirrors that do not vet or filter malicious packages

Blast-radius scenarios

  • An attacker gains reconnaissance data about build environments or developer machines, including host identifiers, which can be used for further targeted attacks.
  • The exfiltrated data could reveal insights into an organization's development infrastructure, aiding in planning more sophisticated supply-chain compromises.

What to do (defensive)

Detect

  • Scan `package.json` and `package-lock.json` files for `@woodpecker-web-shared/components` version 2.20.5.
  • Monitor network traffic from build environments and developer machines for outbound connections to `https://webhook.site/d9bc4bcc-ce74-4193-ae4e-96d234bb2220`.
  • Review `npm install` logs for unexpected script executions or warnings related to postinstall hooks.

Contain

  • Immediately block network access to `https://webhook.site/d9bc4bcc-ce74-4193-ae4e-96d234bb2220` from all development and build environments.
  • Remove `@woodpecker-web-shared/components` version 2.20.5 from all project dependencies.
  • Isolate any systems where the malicious package was installed to prevent further data exfiltration or potential follow-on attacks.

Remediate

  • Update `package.json` to explicitly use a known safe version of `@woodpecker-web-shared/components` (if a legitimate version exists and is needed), or remove the dependency entirely.
  • Ensure `package-lock.json` is committed and used to enforce deterministic dependency resolution.
  • Educate developers on the risks of typosquatting and the importance of verifying package authenticity before installation.
  • Implement or enhance automated dependency scanning tools to detect known malicious packages.

Frontier verdict — High

Prioritize immediate detection and removal of `@woodpecker-web-shared/components` v2.20.5 due to critical host data exfiltration.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.