OpenSSF/OSV advisory MAL-2026-13743 confirms this npm version as malicious. On npm install, the package's postinstall hook runs `node index.js`, which POSTs installer host information — the absolute path of the package file (leaking the OS username and home directory layout), Node.js version, platform, and architecture — to a hardcoded Discord webhook at discord.com/api/webhooks/1530599209269465319/...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in whs4_ued (npm)
Details
On npm install, the package's postinstall hook runs `node index.js`, which POSTs installer host information — the absolute path of the package file (leaking the OS username and home directory layout), Node.js version, platform, and architecture — to a hardcoded Discord webhook at discord.com/api/webhooks/1530599209269465319/. The webhook token is assembled via string concatenation at the call site to evade naive string matching. The destination is attacker-controlled and unrelated to the package's stated educational typo-catcher purpose, and there is no consent gate.
Decision reason
OpenSSF Malicious Packages via OSV confirms whs4_ued@1.0.0 as malicious (MAL-2026-13743): Malicious code in whs4_ued (npm)