Dependency-confusion canary malware: curse-allies-module & helper-agent (npm) beacon to webhook.site and mutate local services on install
Severity: critical · Patch status: no-fix-needed · Since 2026-11-13
Two malicious npm packages, curse-allies-module 1.0.0 and helper-agent 1.0.1/1.0.4, were published to the npm registry and flagged as malware by Amazon Inspector via OpenSSF on 2026-11-13. Both run a postinstall script (node probe.cjs) that unconditionally POSTs install markers to a hardcoded webhook.site collector, confirming to the attacker that the package name resolved and executed in the installer's environment — a dependency-confusion reconnaissance canary enabling follow-on targeted attacks. helper-agent additionally scans localhost ports (1337, 80, 3000, 8080, 5000) and, if a matching JSON API record (id ECT-987654) is found, overwrites that service's manifest via PUT, granting the author write access to a local service. No patched versions exist; the packages should be treated as removed malware.
What to do
- Check dependency trees and lockfiles for curse-allies-module and helper-agent and remove them immediately
- Audit CI/CD and developer machines that installed these packages for signs of execution (outbound POSTs to webhook.site/a4bf0f9f-6d96-46e6-80ac-b76a5329f481, localhost port scans)
- Block the webhook.site collector URL at egress firewalls/proxies
- Enforce npm registry allowlists or internal-only resolution to prevent dependency confusion; disable install lifecycle scripts (e.g. --ignore-scripts)
- Investigate any locally running JSON API on ports 1337/80/3000/8080/5000 for tampered manifests or records with id ECT-987654
Sources
All live incidents on Threat Watch
