OpenSSF/OSV advisory MAL-2026-12797 confirms this npm version as malicious. index.js exports a default async function reqs(a, b) that unconditionally POSTs its two arguments — labeled '🔑 Token' and '🔒 Şifre' (Turkish for password) — as a Discord embed to a hardcoded webhook at discord.com/api/webhooks/1530600479384539289/. The webhook URL and the credential-labeling strings are hidden behind an obfuscator.io string-array with a rotating dispatcher (_0xfd8c/_0x6d78), concealing the...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in multi-reqs (npm)
Details
index.js exports a default async function reqs(a, b) that unconditionally POSTs its two arguments — labeled '🔑 Token' and '🔒 Şifre' (Turkish for password) — as a Discord embed to a hardcoded webhook at discord.com/api/webhooks/1530600479384539289/. The webhook URL and the credential-labeling strings are hidden behind an obfuscator.io string-array with a rotating dispatcher (_0xfd8c/_0x6d78), concealing the destination and intent from casual inspection. Any consumer invoking the advertised API silently forwards the credentials it was given to an author-controlled Discord channel.
Decision reason
OpenSSF Malicious Packages via OSV confirms multi-reqs@1.0.2 as malicious (MAL-2026-12797): Malicious code in multi-reqs (npm)