debug-proxy-chrome-devtools@1.0.2
Vulnerability report · Last retrieved from osv.dev October 8, 2026 at 2:37 AM UTC
OSV ID
MAL-2026-13948
Ecosystem
npm
Summary
debug-proxy-chrome-devtools@1.0.1 declares a postinstall hook ("postinstall": "node install.js") that automatically executes on npm install. install.js uses child_process.execSync to run whoami on the installer's machine and then issues an https.get to a hardcoded webhook.site collector (https://webhook.site/cfe35ac2-bec3-48b8-bae1-a49dea5412c2), passing the captured command output and hostname/command identifiers as URL query parameters. The package advertises itself as a Chrome DevTools debug proxy; that stated purpose has no need for shell reconnaissance or beaconing to a third-party request-inspection service. The combination of automatic install-time execution, capture of installer-side identity data, and a hardcoded non-first-party exfiltration endpoint matches the reconnaissance/beacon shape of a malicious postinstall payload.
Source: amazon-inspector (b7a0986932a47f49b162ea0438acfd0b6293e027e8ac2da46eb1221c5d52646c)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.