OpenSSF/OSV advisory MAL-2026-14353 confirms this npm version as malicious. All three npm lifecycle hooks (preinstall, install, postinstall) invoke install.js, which POSTs the installer's hostname, OS username, current working directory, timestamp, and hook name to a hardcoded webhook.site collector at https://webhook.site/df384ffa-1094-4bbf-a202-e8b345b3ed18/gfe. The exfiltration fires automatically on `npm install` with no caller consent and no configuration...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @gfe/lx-watcher (npm)
Details
All three npm lifecycle hooks (preinstall, install, postinstall) invoke install.js, which POSTs the installer's hostname, OS username, current working directory, timestamp, and hook name to a hardcoded webhook.site collector at https://webhook.site/df384ffa-1094-4bbf-a202-e8b345b3ed18/gfe. The exfiltration fires automatically on `npm install` with no caller consent and no configuration. The package's `main` is a no-op `createWatcher` stub, so a build that resolves this scoped name silently succeeds while host identifiers are leaked. The scoped `@gfe/*` name combined with the no-op stub and the install-time beacon is the canonical dependency-confusion shape: any organization whose private `@gfe/lx-watcher` resolves against the public registry leaks host, username, and install-path metadata to the author-controlled collector.
Decision reason
OpenSSF Malicious Packages via OSV confirms @gfe/lx-watcher@1.5.3 as malicious (MAL-2026-14353): Malicious code in @gfe/lx-watcher (npm)