registry / @zaka13/thing / 1.0.0

@zaka13/thing@1.0.0

OSV Malicious Advisory

imported 24d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-16200 confirms this npm version as malicious. @zaka13/thing@1.0.0 ships the same disguised in-browser proxy kit as webpackbootstrap5 and webpackbootstrapscripts by the same publisher (zaka13). Its YXBp.js loader matches those packages' index-z2b7r4.js (same sha256): it XOR-decodes endpoints with a fixed key, injects remote scripts from https://dyingefforlessefforlessours.com, and boots a Scramjet/wisp WebSocket proxy routing traffic through operator relays...

Advisory

MAL-2026-16200

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @zaka13/thing (npm)

Details

@zaka13/thing@1.0.0 ships the same disguised in-browser proxy kit as webpackbootstrap5 and webpackbootstrapscripts by the same publisher (zaka13). Its YXBp.js loader matches those packages' index-z2b7r4.js (same sha256): it XOR-decodes endpoints with a fixed key, injects remote scripts from https://dyingefforlessefforlessours.com, and boots a Scramjet/wisp WebSocket proxy routing traffic through operator relays. The package presents itself as 'thingy' with an SVG main entry. Harm is browser-side when the asset is served; no install script runs.

Decision reason

No blocking static signals were detected.

References

OSV advisory

Decision evidence

public snapshot

Behavioral surface

Source

DynamicRequireFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 508 KB of source, external domains: 127.0.0.1, curl.se, github.com, www.zlib.net

Oversized source lightweight scan

bG9scmF0aW9u/ejRrc2F0.js2.02 MB file, sampled 256 KB

FilesystemNetworkWebSocketDynamicRequireHighEntropyStringsUrlStrings127.0.0.1curl.segithub.comwww.zlib.net

Source & flagged code

3 flagged

bG9scmF0aW9u/ejRrc2F0.jsView file

1(function(g,f){if(typeof exports=="object"&&typeof module<"u"){module.exports=f(require)}else if("function"==typeof define && define.amd){define("L1bcTransport",["fs","path"],funct... L2: "use strict";

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bG9scmF0aW9u/ejRrc2F0.jsView on unpkg · L1

bG9scmF0aW9u/bG9scmF0aW9u.wasmView file

•path = bG9scmF0aW9u/bG9scmF0aW9u.wasm kind = wasm_module sizeBytes = 583678 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

bG9scmF0aW9u/bG9scmF0aW9u.wasmView on unpkg

logo-b2b3e4d75f89f6104a35c1c7a5972ddd1be2cf72.svgView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

logo-b2b3e4d75f89f6104a35c1c7a5972ddd1be2cf72.svgView on unpkg

Source & flagged code

3 flagged · loading source

bG9scmF0aW9u/ejRrc2F0.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bG9scmF0aW9u/ejRrc2F0.jsView on unpkg · L1

bG9scmF0aW9u/bG9scmF0aW9u.wasmView file

•path = bG9scmF0aW9u/bG9scmF0aW9u.wasm kind = wasm_module sizeBytes = 583678 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

bG9scmF0aW9u/bG9scmF0aW9u.wasmView on unpkg

logo-b2b3e4d75f89f6104a35c1c7a5972ddd1be2cf72.svgView file

Findings

1 High4 Medium4 Low

HighSemantic Analysis Limitedlogo-b2b3e4d75f89f6104a35c1c7a5972ddd1be2cf72.svg

MediumDynamic RequirebG9scmF0aW9u/ejRrc2F0.js

MediumNetwork

MediumShips Wasm ModulebG9scmF0aW9u/bG9scmF0aW9u.wasm

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @zaka13/thing@1.0.0.

See version security history for other recorded verdicts.

Avoid installing @zaka13/thing@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-16 01:30:06.423Z (UTC).

Source advisory published: 2026-09-14 00:00:00.000Z (UTC).