developer-dashboard@1.0.3: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

developer-dashboard@1.0.3: Malicious npm security report (Block) | LPM Firewall

Advisory

MAL-2026-13762

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in developer-dashboard (npm)

Details

The package presents itself as a 'developer dashboard' but ships a heavily obfuscated single-file payload (obfuscator.io-style `_0xXXXX` identifiers with a rotated string array) that harvests Discord tokens, saved logins, MFA/backup codes, stored payment methods (Stripe/Braintree), and account metadata, and additionally scrapes Roblox cookies, Steam data, and Telegram data. The `hooker` routine prepends `os.hostname()` and `os.userInfo().username` to each payload and POSTs the stolen data along with zipped session/log archives (`session.zip`, `logs.zip`) to a hardcoded Discord webhook at `https://discord.com/api/webhooks/1536683755937202208/...`, with a `t.me/umidivouches` Telegram channel referenced in the embed footer. An embedded base64 blob decodes to an Electron `session.webRequest` injection module with `%INJECT_WEBHOOK%` / `%INJECT_DUALHOOK%` placeholders that hook `wss://remote-auth-gateway.discord.gg/*`, `/auth/login`, `/mfa/totp`, and `/users/@me` to intercept Discord authentication in-app. The package also downloads a portable Python runtime (`python.3.10.0.nupkg` from `globalcdn.nuget.org`), extracts `python.exe`, and executes a generated temp script from the install directory — an alternate-runtime dropper unrelated to any dashboard function. Anti-analysis code enumerates blacklisted hostnames/usernames (e.g., `DESKTOP-JHUHOTB`, `WINZDS-VQH86L5D`) and analyst tools (`ghidra`, `hiew`, `sysmon64`, `vboxservice`) to skip execution on researcher machines. ## Source: ghsa-malware (0d577e863cc12fb46e1e454b17c4830181ac0e1f297f84e85718b60270648f3d) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References

OSV advisory ADVISORY PACKAGE PACKAGE

Source & flagged code

9 flagged · loading source

index.jsView file

1const a0_0x5e6b0a=a0_0x2b7d;(function(_0x34c1ef,_0x887b13){const _0x5383f2=a0_0x2b7d,_0xf74132=_0x34c1ef();while(!![]){try{const _0x616dd2=parseInt(_0x5383f2(0x2d0))/0x1*(parseInt(...

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

index.jsView on unpkg · L1

1const a0_0x5e6b0a=a0_0x2b7d;(function(_0x34c1ef,_0x887b13){const _0x5383f2=a0_0x2b7d,_0xf74132=_0x34c1ef();while(!![]){try{const _0x616dd2=parseInt(_0x5383f2(0x2d0))/0x1*(parseInt(...

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

index.jsView on unpkg · L1

1const a0_0x5e6b0a=a0_0x2b7d;(function(_0x34c1ef,_0x887b13){const _0x5383f2=a0_0x2b7d,_0xf74132=_0x34c1ef();while(!![]){try{const _0x616dd2=parseInt(_0x5383f2(0x2d0))/0x1*(parseInt(...

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L1

1const a0_0x5e6b0a=a0_0x2b7d;(function(_0x34c1ef,_0x887b13){const _0x5383f2=a0_0x2b7d,_0xf74132=_0x34c1ef();while(!![]){try{const _0x616dd2=parseInt(_0x5383f2(0x2d0))/0x1*(parseInt(...

High

Shell

Package source references shell execution.

index.jsView on unpkg · L1

1const a0_0x5e6b0a=a0_0x2b7d;(function(_0x34c1ef,_0x887b13){const _0x5383f2=a0_0x2b7d,_0xf74132=_0x34c1ef();while(!![]){try{const _0x616dd2=parseInt(_0x5383f2(0x2d0))/0x1*(parseInt(...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

index.jsView on unpkg · L1

1const a0_0x5e6b0a=a0_0x2b7d;(function(_0x34c1ef,_0x887b13){const _0x5383f2=a0_0x2b7d,_0xf74132=_0x34c1ef();while(!![]){try{const _0x616dd2=parseInt(_0x5383f2(0x2d0))/0x1*(parseInt(...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = developer-dashboard@1.0.2 matchedPath = index.js matchedIdentity = npm:ZGV2ZWxvcGVyLWRhc2hib2FyZA:1.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = bede15bf88a9611b signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = developer-dashboard@1.0.2 matchedPath = index.js matchedIdentity = npm:ZGV2ZWxvcGVyLWRhc2hib2FyZA:1.0.2 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

1const a0_0x5e6b0a=a0_0x2b7d;(function(_0x34c1ef,_0x887b13){const _0x5383f2=a0_0x2b7d,_0xf74132=_0x34c1ef();while(!![]){try{const _0x616dd2=parseInt(_0x5383f2(0x2d0))/0x1*(parseInt(...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L1

Source & flagged code

9 flagged

index.jsView file

1const a0_0x5e6b0a=a0_0x2b7d;(function(_0x34c1ef,_0x887b13){const _0x5383f2=a0_0x2b7d,_0xf74132=_0x34c1ef();while(!![]){try{const _0x616dd2=parseInt(_0x5383f2(0x2d0))/0x1*(parseInt(...

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

index.jsView on unpkg · L1

1const a0_0x5e6b0a=a0_0x2b7d;(function(_0x34c1ef,_0x887b13){const _0x5383f2=a0_0x2b7d,_0xf74132=_0x34c1ef();while(!![]){try{const _0x616dd2=parseInt(_0x5383f2(0x2d0))/0x1*(parseInt(...

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

index.jsView on unpkg · L1

1const a0_0x5e6b0a=a0_0x2b7d;(function(_0x34c1ef,_0x887b13){const _0x5383f2=a0_0x2b7d,_0xf74132=_0x34c1ef();while(!![]){try{const _0x616dd2=parseInt(_0x5383f2(0x2d0))/0x1*(parseInt(...

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L1

1const a0_0x5e6b0a=a0_0x2b7d;(function(_0x34c1ef,_0x887b13){const _0x5383f2=a0_0x2b7d,_0xf74132=_0x34c1ef();while(!![]){try{const _0x616dd2=parseInt(_0x5383f2(0x2d0))/0x1*(parseInt(...

High

Shell

Package source references shell execution.

index.jsView on unpkg · L1

1const a0_0x5e6b0a=a0_0x2b7d;(function(_0x34c1ef,_0x887b13){const _0x5383f2=a0_0x2b7d,_0xf74132=_0x34c1ef();while(!![]){try{const _0x616dd2=parseInt(_0x5383f2(0x2d0))/0x1*(parseInt(...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

index.jsView on unpkg · L1

1const a0_0x5e6b0a=a0_0x2b7d;(function(_0x34c1ef,_0x887b13){const _0x5383f2=a0_0x2b7d,_0xf74132=_0x34c1ef();while(!![]){try{const _0x616dd2=parseInt(_0x5383f2(0x2d0))/0x1*(parseInt(...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = developer-dashboard@1.0.2 matchedPath = index.js matchedIdentity = npm:ZGV2ZWxvcGVyLWRhc2hib2FyZA:1.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = bede15bf88a9611b signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = developer-dashboard@1.0.2 matchedPath = index.js matchedIdentity = npm:ZGV2ZWxvcGVyLWRhc2hib2FyZA:1.0.2 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

1const a0_0x5e6b0a=a0_0x2b7d;(function(_0x34c1ef,_0x887b13){const _0x5383f2=a0_0x2b7d,_0xf74132=_0x34c1ef();while(!![]){try{const _0x616dd2=parseInt(_0x5383f2(0x2d0))/0x1*(parseInt(...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L1