w-mousekey@1.0.42
OpenSSF/OSV Malicious Advisory
imported 10d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18293 confirms this npm version as malicious.
Advisory
MAL-2026-18293
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in w-mousekey (npm)
Details
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
References
Independent LPM AI assessment
Manual ReviewIndependent AI assessment: manual_review. LPM AI review remains unresolved.
The inspected source connects the bundled executables to the package’s desktop automation features, with no separate attack behavior established. Required native analysis remains incomplete, so the package cannot be marked clean.
Static reason
No blocking static signals were detected.
Trigger
The package’s Windows screenshot or mouse and keyboard functions invoke the bundled executables.
Impact
The available source does not establish malicious impact, but the native executables prevent a clean determination.
Mechanism
The JavaScript passes screenshot output paths or defined mouse and keyboard actions to those executables; their complete native behavior remains unresolved.
AI rationale
The inspected source connects the bundled executables to the package’s desktop automation features, with no separate attack behavior established. Required native analysis remains incomplete, so the package cannot be marked clean.
Evidence
.lpm-inspection-MlXa6D/0-fa44d971ea48.txt.lpm-inspection-MlXa6D/1-3880f9ec464d.txt_screenCapture/screenCapture_1.3.2.exe_autoHotkey/AutoHotkey64.exesrc/screen.mjssrc/mousekey.mjs
Independent scan evidence
public snapshotAI called this Manual Review at 89.0% confidence as Unknown with medium false-positive risk.
AI review observations
- package.json sets the main entrypoint to dist/w-mousekey.umd.js and declares no lifecycle hooks.
- The source uses AutoHotkey to carry out mouse and keyboard actions and a bundled executable to capture screenshots, matching the package’s desktop automation functions.
- Offline analysis could not fully inspect the bundled screen capture executable; analysis of AutoHotkey also reports uninspected native call targets.
Evidence against
- The inspected JavaScript invokes the bundled executables for specific mouse, keyboard, and screenshot functions; no separate attack behavior was established.
Behavioral surface
ChildProcessEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
6 flagged_screenCapture/screenCapture_1.3.2.exeView file
•path = _screenCapture/screenCapture_1.3.2.exe
kind = native_binary
sizeBytes = 12800
magicHex = [redacted]
Medium
Ships Native Binary
Package ships native binary artifacts.
_screenCapture/screenCapture_1.3.2.exeView on unpkg_autoHotkey/Install.cmdView file
•path = _autoHotkey/Install.cmd
kind = build_helper
sizeBytes = 66
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
_autoHotkey/Install.cmdView on unpkgpackage.jsonView file
2"name": "w-mousekey",
"version": "1.0.42",
"main": "dist/w-mousekey.umd.js",
"dependencies": {
"@techstark/opencv-js": "^4.12.0-release.1",
"json5": "^2.2.3",
"
Findings
4 High4 Medium4 Low
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidencesrc/mousekey.mjs
HighAi Review Evidencesrc/screen.mjs
HighAi Review Evidence.lpm-inspection-MlXa6D/0-fa44d971ea48.txt
MediumNetwork
MediumShips Native Binary_screenCapture/screenCapture_1.3.2.exe
MediumShips Build Helper_autoHotkey/Install.cmd
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to w-mousekey@1.0.42.
See all versions of w-mousekey for other recorded verdicts.
- Avoid installing w-mousekey@1.0.42. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.