OpenSSF/OSV advisory MAL-2026-12815 confirms this npm version as malicious. widget-forge@9999.0.0 is a dependency-confusion beacon. package.json declares scripts.preinstall = 'node callback.js', which auto-runs on npm install. callback.js collects os.hostname(), os.userInfo().username, process.cwd(), npm_config_registry, and CI repository identifiers (GITHUB_REPOSITORY and related CI env vars) and sends them via HTTP GET to the hardcoded bare-IP endpoint...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in widget-forge (npm)
Details
widget-forge@9999.0.0 is a dependency-confusion beacon. package.json declares scripts.preinstall = 'node callback.js', which auto-runs on npm install. callback.js collects os.hostname(), os.userInfo().username, process.cwd(), npm_config_registry, and CI repository identifiers (GITHUB_REPOSITORY and related CI env vars) and sends them via HTTP GET to the hardcoded bare-IP endpoint http://75.119.137.232:31337/depconfuse?pkg=.... The package has no functional payload: main is an empty object export, the description is a generic placeholder, and the version 9999.0.0 is the pattern used to outbid internal package versions in dependency-confusion attacks. The only effect of installation is the recon callback to the hardcoded IP.
Decision reason
OpenSSF Malicious Packages via OSV confirms widget-forge@9999.0.0 as malicious (MAL-2026-12815): Malicious code in widget-forge (npm)