OpenSSF/OSV advisory MAL-2026-2446 confirms this npm version as malicious. index.js uses child_process to execute `whoami` and gather `hostname` information, then transmits results via https.get to api.telegram.org/bot — a well-known pattern for Telegram-bot-based C2/exfiltration. The package name mimics a corporate UI library but the code performs system reconnaissance and exfiltration of installer host data, with no legitimate UI-library functionality indicated at the entry point...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @corpweb-ui/wmkt-library (npm)
Details
index.js uses child_process to execute `whoami` and gather `hostname` information, then transmits results via https.get to api.telegram.org/bot — a well-known pattern for Telegram-bot-based C2/exfiltration. The package name mimics a corporate UI library but the code performs system reconnaissance and exfiltration of installer host data, with no legitimate UI-library functionality indicated at the entry point. Any installer or build system that pulls this package will leak the machine's user and hostname to an attacker-controlled Telegram bot on require/load. Three independent static detections (child-process + https exfiltration, nodejs system exfiltration, simple sysinfo exfiltration) corroborate a single small file implementing a classic recon beacon.
## Source: ossf-package-analysis (e04e7522e73249638f1fd02bc8b13369626291222da0a2ba1612bbcba6a14bad) The OpenSSF Package Analysis project identified '@corpweb-ui/wmkt-library' @ 99.99.11 (npm) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
Decision reason
OpenSSF Malicious Packages via OSV confirms @corpweb-ui/wmkt-library@99.99.12 as malicious (MAL-2026-2446): Malicious code in @corpweb-ui/wmkt-library (npm)